CVE-2024-22167

HighCVSS 7.9/10Last modified Jun 17, 2026

Description

A potential DLL hijacking vulnerability in the SanDisk PrivateAccess application for Windows that could lead to arbitrary code execution in the context of the system user. This vulnerability is only exploitable locally if an attacker has access to a copy of the user's vault or has already gained access into a user's system. This attack is limited to the system in context and cannot be propagated.

Metrics

CVSS 3.1 7.9/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H

Weakness enumeration

CWE-427

Affected software

No affected versions have been published.

Timeline

Published: Mar 13, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-221685.9A Cross-Site Scripting (XSS) vulnerability on the My Cloud, My Cloud Home, SanDisk ibi, and WD Cloud web apps was found which could allow an CVE-2024-221697.1WD Discovery versions prior to 5.0.589 contain a misconfiguration in the Node.js environment settings that could allow code execution by uti CVE-2024-22177.5gaizhenbiao/chuanhuchatgpt is vulnerable to improper access control, allowing unauthorized access to the `config.json` file. This vulnerabil CVE-2024-221709.2Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Western Digital My Cloud ddns-start on Linux allows CVE-2024-221775.5in OpenHarmony v3.2.4 and prior versions allow a local attacker cause apps crash through get permission.CVE-2024-221784.9A file write vulnerability exists in the OAS Engine Save Security Configuration functionality of Open Automation Software OAS Platform V19.0 CVE-2024-221797.5The application is vulnerable to an unauthenticated parameter manipulation that allows an attacker to set the credentials to blank giving CVE-2024-22184.6The LuckyWP Table of Contents WordPress plugin through 2.1.4 does not sanitise and escape some of its settings, which could allow high privi CVE-2024-221805.5in OpenHarmony v4.0.0 and prior versions allow a local attacker cause DOS through use after free.CVE-2024-221817.8An out-of-bounds write vulnerability exists in the readNODE functionality of libigl v2.5.0. A specially crafted .node file can lead to an ou CVE-2024-221828.6A remote, unauthenticated attacker may be able to send crafted messages to the web server of the Commend WS203VICM causing the system to r CVE-2024-221847.8Uncontrolled search path for some Intel(R) Quartus(R) Prime Pro Edition Design Software before version 24.1 may allow an authenticated user