CVE-2024-22169

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

WD Discovery versions prior to 5.0.589 contain a misconfiguration in the Node.js environment settings that could allow code execution by utilizing the 'ELECTRON_RUN_AS_NODE' environment variable. Any malicious application operating with standard user permissions can exploit this vulnerability, enabling code execution within WD Discovery application's context. WD Discovery version 5.0.589 addresses this issue by disabling certain features and fuses in Electron. The attack vector for this issue requires the victim to have the WD Discovery app installed on their device.

Metrics

CVSS 4.0 7.1/10

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Aug 2, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-22177.5gaizhenbiao/chuanhuchatgpt is vulnerable to improper access control, allowing unauthorized access to the `config.json` file. This vulnerabil CVE-2024-221709.2Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Western Digital My Cloud ddns-start on Linux allows CVE-2024-221775.5in OpenHarmony v3.2.4 and prior versions allow a local attacker cause apps crash through get permission.CVE-2024-221784.9A file write vulnerability exists in the OAS Engine Save Security Configuration functionality of Open Automation Software OAS Platform V19.0 CVE-2024-221797.5The application is vulnerable to an unauthenticated parameter manipulation that allows an attacker to set the credentials to blank giving CVE-2024-22184.6The LuckyWP Table of Contents WordPress plugin through 2.1.4 does not sanitise and escape some of its settings, which could allow high privi CVE-2024-221805.5in OpenHarmony v4.0.0 and prior versions allow a local attacker cause DOS through use after free.CVE-2024-221817.8An out-of-bounds write vulnerability exists in the readNODE functionality of libigl v2.5.0. A specially crafted .node file can lead to an ou CVE-2024-221828.6A remote, unauthenticated attacker may be able to send crafted messages to the web server of the Commend WS203VICM causing the system to r CVE-2024-221847.8Uncontrolled search path for some Intel(R) Quartus(R) Prime Pro Edition Design Software before version 24.1 may allow an authenticated user CVE-2024-221857.2Time-of-check Time-of-use Race Condition in some Intel(R) processors with Intel(R) ACTM may allow a privileged user to potentially enable es CVE-2024-221868.8The application suffers from a privilege escalation vulnerability. An attacker logged in as guest can escalate his privileges by poisoning