CVE-2022-38699 - Vulnerability Details - OpenCVE

Armoury Crate Service’s logging function has insufficient validation to check if the log file is a symbolic link. A physical attacker with general user privilege can modify the log file property to a symbolic link that points to arbitrary system file, causing the logging function to overwrite the system file and disrupt the system.

No CVSS v4.0

Attack Vector Physical

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00041.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Asus	Armoury Crate Service

Configuration 1 [-]

cpe:2.3:a:asus:armoury_crate_service:*:*:*:*:*:*:*:*

No data.

No data.

Fixes

Solution

Update Armoury Crate Service version to V5.2.10.0

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.twcert.org.tw/tw/cp-132-6522-4eacb-1.html

History

Wed, 21 May 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: twcert

Published: 2022-09-28T03:25:34.591Z

Updated: 2025-05-21T14:54:16.472Z

Reserved: 2022-08-23T00:00:00.000Z

Link: CVE-2022-38699

Vulnrichment

Updated: 2024-08-03T11:02:14.548Z

NVD

Status : Modified

Published: 2022-09-28T04:15:13.857

Modified: 2024-11-21T07:16:57.307

Link: CVE-2022-38699

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "Armoury Crate Service", "vendor": "ASUS", "versions": [{"status": "affected", "version": "5.1.5.0"}]}], "datePublic": "2022-09-15T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "Armoury Crate Service\u2019s logging function has insufficient validation to check if the log file is a symbolic link. A physical attacker with general user privilege can modify the log file property to a symbolic link that points to arbitrary system file, causing the logging function to overwrite the system file and disrupt the system."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-59", "description": "CWE-59 Improper Link Resolution Before File Access ('Link Following')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-09-28T03:25:34.000Z", "orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.twcert.org.tw/tw/cp-132-6522-4eacb-1.html"}], "solutions": [{"lang": "en", "value": "Update Armoury Crate Service version to V5.2.10.0"}], "source": {"advisory": "TVN-202209001", "discovery": "EXTERNAL"}, "title": "ASUS Armoury Crate Service - Arbitrary File Creation via Elevation of Privilege Flaw", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"AKA": "TWCERT/CC", "ASSIGNER": "cve@cert.org.tw", "DATE_PUBLIC": "2022-09-15T07:57:00.000Z", "ID": "CVE-2022-38699", "STATE": "PUBLIC", "TITLE": "ASUS Armoury Crate Service - Arbitrary File Creation via Elevation of Privilege Flaw"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Armoury Crate Service", "version": {"version_data": [{"version_affected": "=", "version_value": "5.1.5.0"}]}}]}, "vendor_name": "ASUS"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Armoury Crate Service\u2019s logging function has insufficient validation to check if the log file is a symbolic link. A physical attacker with general user privilege can modify the log file property to a symbolic link that points to arbitrary system file, causing the logging function to overwrite the system file and disrupt the system."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-59 Improper Link Resolution Before File Access ('Link Following')"}]}]}, "references": {"reference_data": [{"name": "https://www.twcert.org.tw/tw/cp-132-6522-4eacb-1.html", "refsource": "MISC", "url": "https://www.twcert.org.tw/tw/cp-132-6522-4eacb-1.html"}]}, "solution": [{"lang": "en", "value": "Update Armoury Crate Service version to V5.2.10.0"}], "source": {"advisory": "TVN-202209001", "discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T11:02:14.548Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.twcert.org.tw/tw/cp-132-6522-4eacb-1.html"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-21T14:54:09.894843Z", "id": "CVE-2022-38699", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-21T14:54:16.472Z"}}]}, "cveMetadata": {"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "assignerShortName": "twcert", "cveId": "CVE-2022-38699", "datePublished": "2022-09-28T03:25:34.591Z", "dateReserved": "2022-08-23T00:00:00.000Z", "dateUpdated": "2025-05-21T14:54:16.472Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"containers": {"cna": {"affected": [{"product": "Armoury Crate Service", "vendor": "ASUS", "versions": [{"status": "affected", "version": "5.1.5.0"}]}], "datePublic": "2022-09-15T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "Armoury Crate Service\u2019s logging function has insufficient validation to check if the log file is a symbolic link. A physical attacker with general user privilege can modify the log file property to a symbolic link that points to arbitrary system file, causing the logging function to overwrite the system file and disrupt the system."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-59", "description": "CWE-59 Improper Link Resolution Before File Access ('Link Following')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-09-28T03:25:34.000Z", "orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.twcert.org.tw/tw/cp-132-6522-4eacb-1.html"}], "solutions": [{"lang": "en", "value": "Update Armoury Crate Service version to V5.2.10.0"}], "source": {"advisory": "TVN-202209001", "discovery": "EXTERNAL"}, "title": "ASUS Armoury Crate Service - Arbitrary File Creation via Elevation of Privilege Flaw", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"AKA": "TWCERT/CC", "ASSIGNER": "cve@cert.org.tw", "DATE_PUBLIC": "2022-09-15T07:57:00.000Z", "ID": "CVE-2022-38699", "STATE": "PUBLIC", "TITLE": "ASUS Armoury Crate Service - Arbitrary File Creation via Elevation of Privilege Flaw"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Armoury Crate Service", "version": {"version_data": [{"version_affected": "=", "version_value": "5.1.5.0"}]}}]}, "vendor_name": "ASUS"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Armoury Crate Service\u2019s logging function has insufficient validation to check if the log file is a symbolic link. A physical attacker with general user privilege can modify the log file property to a symbolic link that points to arbitrary system file, causing the logging function to overwrite the system file and disrupt the system."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-59 Improper Link Resolution Before File Access ('Link Following')"}]}]}, "references": {"reference_data": [{"name": "https://www.twcert.org.tw/tw/cp-132-6522-4eacb-1.html", "refsource": "MISC", "url": "https://www.twcert.org.tw/tw/cp-132-6522-4eacb-1.html"}]}, "solution": [{"lang": "en", "value": "Update Armoury Crate Service version to V5.2.10.0"}], "source": {"advisory": "TVN-202209001", "discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T11:02:14.548Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.twcert.org.tw/tw/cp-132-6522-4eacb-1.html"}]}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-38699", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-05-21T14:54:09.894843Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-21T14:54:12.964Z"}}]}, "cveMetadata": {"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "assignerShortName": "twcert", "cveId": "CVE-2022-38699", "datePublished": "2022-09-28T03:25:34.591Z", "dateReserved": "2022-08-23T00:00:00.000Z", "dateUpdated": "2025-05-21T14:54:16.472Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:asus:armoury_crate_service:*:*:*:*:*:*:*:*", "matchCriteriaId": "1A350A1C-4322-4A32-8621-0B4D56A4EE05", "versionEndExcluding": "5.2.10.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Armoury Crate Service\u2019s logging function has insufficient validation to check if the log file is a symbolic link. A physical attacker with general user privilege can modify the log file property to a symbolic link that points to arbitrary system file, causing the logging function to overwrite the system file and disrupt the system."}, {"lang": "es", "value": "La funci\u00f3n logging de Armoury Crate Service presenta una comprobaci\u00f3n insuficiente para comprobar si el archivo de registro es un enlace simb\u00f3lico. Un atacante f\u00edsico con privilegio de usuario general puede modificar la propiedad del archivo de registro a un enlace simb\u00f3lico que apunte a un archivo de sistema arbitrario, causando que la funci\u00f3n de registro sobrescriba el archivo de sistema y perturbe el sistema"}], "id": "CVE-2022-38699", "lastModified": "2024-11-21T07:16:57.307", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.7, "impactScore": 5.2, "source": "twcert@cert.org.tw", "type": "Secondary"}]}, "published": "2022-09-28T04:15:13.857", "references": [{"source": "twcert@cert.org.tw", "tags": ["Third Party Advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-6522-4eacb-1.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-6522-4eacb-1.html"}], "sourceIdentifier": "twcert@cert.org.tw", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "twcert@cert.org.tw", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-59"}], "source": "nvd@nist.gov", "type": "Primary"}]}