CVE-2022-41700

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Insecure inherited permissions in some Intel(R) NUC Pro Software Suite installation software before version 2.0.0.9 may allow an authenticated user to potentially enable escalation of privilege via local access.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-277 CWE-732 CWE-269

Affected software

Vendor	Product	Versions
n/a	Intel(R) NUC Pro Software Suite installation software	before version 2.0.0.9
intel	nuc_pro_software_suite	< 2.0.0.9

References

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00908.htmlPatch, Vendor Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00908.htmlPatch, Vendor Advisory

Timeline

Published: Nov 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-417015.4The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the Put CVE-2022-417025.4The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the Ins CVE-2022-417035.4A vulnerability in the SQL Alchemy connector of Apache Superset allows an authenticated user with read access to a specific database to add CVE-2022-417047.5A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Gra CVE-2022-417059.8Badaso version 2.6.3 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because th CVE-2022-417068.2Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application do CVE-2022-417076.5Relatedcode's Messenger version 7bcd20b allows an authenticated external attacker to access sensitive data of any user of the application. T CVE-2022-417084.3Relatedcode's Messenger version 7bcd20b allows an authenticated external attacker to access existing chats in the workspaces of any user of CVE-2022-417097.8Markdownify version 1.4.1 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdo CVE-2022-41717.5The demon image annotation plugin for WordPress is vulnerable to improper input validation in versions up to, and including 5.0. This is due CVE-2022-417105.5Markdownify version 1.4.1 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a malicio CVE-2022-417119.8Badaso version 2.6.0 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because th