Vulnerability · Published Jul 20, 2022 · Assigned by jpcert
CVE-2022-34866
High 7.8
In plain English
A high-severity security flaw in Passage Drive from Yokogawa Rental & Lease Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).
Severity (CVSS NVD)7.8High
Exploit odds (30 days)0.2%top 89.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Passage Drive versions v1.4.0 to v1.5.1.0 and Passage Drive for Box version v1.0.0 contain an insufficient data verification vulnerability for interprocess communication. By running a malicious program, an arbitrary OS command may be executed with LocalSystem privilege of the Windows system where the product is running.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Yokogawa Rental & Lease Corporation | Passage Drive | Passage Drive versions v1.4.0 to v1.5.1.0 and Passage Drive for Box version v1.0.0 |
References
- https://www.yrl.com/fwp_support/info/a1hrbt0000002037.html x_refsource_MISC
- https://jvn.jp/en/jp/JVN23766146/index.html x_refsource_MISC