High severity · published Sep 9, 2022
CVE-2022-39845
Improper validation of integrity check vulnerability in Samsung Kies prior to version 2.6.4.22074 allows local attackers to delete arbitrary directory using directory junction
7.1
CVSS
0.1%
EPSS
No
On KEV
Description
Improper validation of integrity check vulnerability in Samsung Kies prior to version 2.6.4.22074 allows local attackers to delete arbitrary directory using directory junction.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KI
Kies · Samsung
before 2.6.4.22074 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-39845
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-39845
Vendor Advisory
https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=09
More from Kies
9.8
CVE-2012-3807
Samsung Kies before 2.5.0.12094_27_11 has arbitrary file execution
7.8
CVE-2022-30744
DLL hijacking vulnerability in KiesWrapper in Samsung Kies prior to version 2.6.4.22043_1 allows attacker to execute arbitrary code
7.8
CVE-2022-27843
DLL hijacking vulnerability in Kies prior to version 2.6.4.22014_2 allows attacker to execute abitrary code
7.5
CVE-2012-3810
Samsung Kies before 2.5.0.12094_27_11 has registry modification
7.5
CVE-2012-3809
Samsung Kies before 2.5.0.12094_27_11 has arbitrary directory modification