Vulnerability Details : CVE-2022-39909
Insufficient verification of data authenticity vulnerability in Samsung Gear IconX PC Manager prior to version 2.1.221019.51 allows local attackers to create arbitrary file using symbolic link.
Exploit prediction scoring system (EPSS) score for CVE-2022-39909
Probability of exploitation activity in the next 30 days: 0.04%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 6 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2022-39909
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
7.1
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H |
1.8
|
5.2
|
Samsung Mobile |
|
5.5
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
1.8
|
3.6
|
NIST |
CWE ids for CVE-2022-39909
-
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.Assigned by:
- mobile.security@samsung.com (Secondary)
- nvd@nist.gov (Primary)
References for CVE-2022-39909
-
https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=12
Security Updates Other Updates | Samsung Mobile SecurityVendor Advisory
Products affected by CVE-2022-39909
- cpe:2.3:a:samsung:gear_iconx_pc_manager:*:*:*:*:*:*:*:*