CVE-2022-35899

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

There is an unquoted service path in ASUSTeK Aura Ready Game SDK service (GameSDK.exe) 1.0.0.4. This might allow a local user to escalate privileges by creating a %PROGRAMFILES(X86)%\ASUS\GameSDK.exe file.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-428

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/AngeloPioAmirante/CVE-2022-35899Exploit, Third Party Advisory
https://packetstormsecurity.com/files/167763/Asus-GameSDK-1.0.0.4-Unquoted-Service-Path.htmlExploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/50985Exploit, Third Party Advisory, VDB Entry
https://github.com/AngeloPioAmirante/CVE-2022-35899Exploit, Third Party Advisory
https://packetstormsecurity.com/files/167763/Asus-GameSDK-1.0.0.4-Unquoted-Service-Path.htmlExploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/50985Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Jul 21, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-35905.9WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation ch CVE-2022-359003.3An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected version of MicroStatio CVE-2022-359013.3An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected version of MicroStatio CVE-2022-359023.3An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected version of MicroStatio CVE-2022-359033.3An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected version of MicroStatio CVE-2022-359043.3An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected version of MicroStatio CVE-2022-359053.3An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected version of MicroStatio CVE-2022-359063.3An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected version of MicroStatio CVE-2022-359088.8Cambium Enterprise Wi-Fi System Software before 6.4.2 does not sanitize the ping host argument in device-agent.CVE-2022-359098.8In Jellyfin before 10.8, the /users endpoint has incorrect access control for admin functionality.CVE-2022-35917.8Use After Free in GitHub repository vim/vim prior to 9.0.0789.CVE-2022-359105.4In Jellyfin before 10.8, stored XSS allows theft of an admin access token.