CVE-2022-38604
Published: 11 April 2023
Summary
CVE-2022-38604 is a high-severity Link Following (CWE-59) vulnerability in Wacom Driver. Its CVSS base score is 7.3 (High).
Operationally, ranked in the top 15.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Wacom Driver version 6.3.46-1 for Windows and earlier releases contain an arbitrary file deletion vulnerability tracked as CVE-2022-38604. The flaw is classified under CWE-59 and carries a CVSS 3.1 score of 7.3, reflecting local access requirements with low attack complexity, low privileges, and user interaction.
An authenticated local user can exploit the issue to delete arbitrary files on the system, resulting in high impact to confidentiality, integrity, and availability. The attack vector is local and does not require elevated privileges beyond a standard user account.
Public references consist of a GitHub repository and accompanying technical blog posts that document the finding; no vendor advisory or patch information is included in the supplied references. The associated EPSS score reached a peak of 0.0506 before receding to its current value of 0.0204, with no reported evidence of in-the-wild exploitation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-41181
Vulnerability details
Wacom Driver 6.3.46-1 for Windows and lower was discovered to contain an arbitrary file deletion vulnerability.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.