CVE-2022-27229

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Path transversal in some Intel(R) NUC Kits NUC7i3DN, NUC7i5DN, NUC7i7DN HDMI firmware update tool software before version 1.79.1.1 may allow an authenticated user to potentially enable escalation of privilege via local access.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-249 CWE-22

Affected software

Vendor	Product	Versions
n/a	Intel(R) NUC Kits NUC7i3DN, NUC7i5DN, NUC7i7DN HDMI firmware update tool software	before version 1.79.1.1
intel	nuc_hdmi_firmware_update_tool	< 1.79.1.1
intel	nuc_kit_nuc7i3dnhe	< *
intel	nuc_kit_nuc7i3dnke	< *
intel	nuc_kit_nuc7i5dnhe	< *
intel	nuc_kit_nuc7i5dnke	< *
intel	nuc_kit_nuc7i7dnhe	< *
intel	nuc_kit_nuc7i7dnke	< *

References

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00908.htmlPatch, Vendor Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00908.htmlPatch, Vendor Advisory

Timeline

Published: Nov 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-27239.8A vulnerability was found in SourceCodester Employee Management System. It has been classified as critical. Affected is an unknown function CVE-2022-272306.1On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP APM, and F5 BIG-IP Guided Configuration (GC) all versions CVE-2022-272316.1Cross-site scripting vulnerability exists in WP Statistics versions prior to 13.2.0 because it improperly processes a platform parameter. By CVE-2022-272337.5XML injection in the Quartus(R) Prime Programmer included in the Intel(R) Quartus Prime Pro and Standard edition software may allow an unaut CVE-2022-272346.5Server-side request forgery in the CVAT software maintained by Intel(R) before version 2.0.1 may allow an authenticated user to potentially CVE-2022-272358.8Multiple Broken Access Control vulnerabilities in Social Share Buttons by Supsystic plugin <= 2.2.3 at WordPress.CVE-2022-272376.1There is a cross-site scripting (XSS) vulnerability in an NI Web Server component installed with several NI products. Depending on the produ CVE-2022-272385.4BigBlueButton version 2.4.7 (or earlier) is vulnerable to stored Cross-Site Scripting (XSS) in the private chat functionality. A threat acto CVE-2022-272397.8In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could lead to local attacker CVE-2022-27249.8A vulnerability was found in SourceCodester Employee Management System. It has been declared as critical. Affected by this vulnerability is CVE-2022-272409.8scheme/webauthn.c in Glewlwyd SSO server 2.x before 2.6.2 has a buffer overflow associated with a webauthn assertion.CVE-2022-272417.5A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.31), Mendix Applications using Mendix 8 (All