CVE-2022-46338 — Incorrect Permission Assignment in G810-led

CWE-732 — Incorrect Permission AssignmentCWE-668 — Resource Exposure4 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
0.2%
top 52.50%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
G810-led Project G810-ledDebian G810-ledDebian Linux
Timeline
PublishedNov 30

Description

g810-led 0.4.2, a LED configuration tool for Logitech Gx10 keyboards, contained a udev rule to make supported device nodes world-readable and writable, allowing any process on the system to read traffic from keyboards, including sensitive data.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/g810-led< g810-led 0.4.2-3 (bookworm)
▶Debiang810-led_project/g810-led< 0.4.2-1+deb11u1+3

Also affects: Debian Linux 10.0

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
OSV
CVE-2022-46338: g810-led 0↗2022-11-30
▶
GHSA
GHSA-qj7j-xm3v-qchm: g810-led 0↗2022-11-30
▶

📋Vendor Advisories

1
Debian
CVE-2022-46338: g810-led - g810-led 0.4.2, a LED configuration tool for Logitech Gx10 keyboards, contained ...↗2022
▶