CVE-2022-22996

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The G-RAID 4/8 Software Utility setups for Windows were affected by a DLL hijacking vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the system user.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

Vendor	Product	Versions
SanDisk Professional	G-RAID 4/8 Software Utility	>= G-RAID 4/8 Software Utility, < 300520006-2; >= G-RAID Windows Driver, < V6.2.0,16-2

References

Timeline

Published: Mar 30, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-229979.8Addressed a remote code execution vulnerability by resolving a command injection vulnerability and closing an AWS S3 bucket that potentially CVE-2022-229987.5Implemented protections on AWS credentials that were not properly protected.CVE-2022-229994.8Western Digital My Cloud devices are vulnerable to a cross side scripting vulnerability that can allow a malicious user with elevated privil CVE-2022-23005.4Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.19.CVE-2022-230007.8The Western Digital My Cloud Web App [https://os5.mycloud.com/] uses a weak SSLContext when attempting to configure port forwarding rules. T CVE-2022-230015.3When compressing or decompressing elliptic curve points using the Sweet B library, an incorrect choice of sign bit is used. An attacker with CVE-2022-230025.3When compressing or decompressing a point on the NIST P-256 elliptic curve with an X coordinate of zero, the resulting output is not properl CVE-2022-230035.3When computing a shared secret or point multiplication on the NIST P-256 curve that results in an X coordinate of zero, the resulting output CVE-2022-230045.3When computing a shared secret or point multiplication on the NIST P-256 curve using a public key with an X coordinate of zero, an error is CVE-2022-230058.7Western Digital has identified a weakness in the UFS standard that could result in a security vulnerability. This vulnerability may exist in CVE-2022-230066.7A stack-based buffer overflow vulnerability was found on Western Digital My Cloud Home, My Cloud Home Duo, and SanDisk ibi that could allow CVE-2022-230085.4On NGINX Controller API Management versions 3.18.0-3.19.0, an authenticated attacker with access to the "user" or "admin" role can use undis