CVE-2022-42488

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

OpenHarmony-v3.1.2 and prior versions have a Missing permission validation vulnerability in param service of startup subsystem. An malicious application installed on the device could elevate its privileges to the root user, disable security features, or cause DoS by disabling particular services.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287 CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Oct 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-42496.1A vulnerability, which was classified as problematic, was found in Movie Ticket Booking System. Affected is an unknown function of the compo CVE-2022-424909.8Several OS command injection vulnerabilities exist in the m2m binary of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted netw CVE-2022-424919.8Several OS command injection vulnerabilities exist in the m2m binary of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted netw CVE-2022-424929.8Several OS command injection vulnerabilities exist in the m2m binary of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted netw CVE-2022-424939.8Several OS command injection vulnerabilities exist in the m2m binary of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted netw CVE-2022-424946.5Server Side Request Forgery (SSRF) vulnerability in All in One SEO Pro plugin <= 4.2.5.1 on WordPress.CVE-2022-424969.8OS command injection vulnerability in Nako3edit, editor component of nadesiko3 (PC Version) v3.3.74 and earlier allows a remote attacker to CVE-2022-424979.8Arbitrary Code Execution vulnerability in Api2Cart Bridge Connector plugin <= 1.1.0 on WordPress.CVE-2022-424989.8In Pixel cellular firmware, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution CVE-2022-424999.8In sms_SendMmCpErrMsg of sms_MmConManagement.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to re CVE-2022-42506.1A vulnerability has been found in Movie Ticket Booking System and classified as problematic. Affected by this vulnerability is an unknown fu CVE-2022-425006.7In OEM_OnRequest of sced.cpp, there is a possible shell command execution due to improper input validation. This could lead to local escalat