CVE-2022-44898

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The MsIo64.sys component in Asus Aura Sync through v1.07.79 does not properly validate input to IOCTL 0x80102040, 0x80102044, 0x80102050, and 0x80102054, allowing attackers to trigger a memory corruption and cause a Denial of Service (DoS) or escalate privileges via crafted IOCTL requests.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Dec 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-449009.1A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr v0.20.0 and earlier allows attacke CVE-2022-44915.4The WP-Table Reloaded WordPress plugin through 1.9.4 does not validate and escapes some of its shortcode attributes before outputting them b CVE-2022-449107.8Binbloom 2.0 was discovered to contain a heap buffer overflow via the read_pointer function at /binbloom-master/src/helpers.c.CVE-2022-44927.5The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step CVE-2022-449289.8D-Link DVG-G5402SP GE_1.03 was discovered to contain a command injection vulnerability via the Maintenance function.CVE-2022-449299.8An access control issue in D-Link DVG-G5402SP GE_1.03 allows unauthenticated attackers to escalate privileges via arbitrarily editing VoIP S CVE-2022-44939.8A vulnerability classified as critical was found in scifio. Affected by this vulnerability is the function downloadAndUnpackResource of the CVE-2022-449309.8D-Link DHP-W310AV 3.10EU was discovered to contain a command injection vulnerability via the System Checks function.CVE-2022-449317.5Tenda A18 v15.13.07.09 was discovered to contain a stack overflow via the security_5g parameter at /goform/WifiBasicSet.CVE-2022-449327.5An access control issue in Tenda A18 v15.13.07.09 allows unauthenticated attackers to access the Telnet service.CVE-2022-449376.5Bosscms v2.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Add function under the Administrator List module.CVE-2022-449389.8Weak reset token generation in SeedDMS v6.0.20 and v5.1.7 allows attackers to execute a full account takeover via a brute force attack.