Unquoted Service Path Vulnerability in Fujitsu PlugFree Network Software
CVE-2022-27089

7.8HIGH

Key Information:

Vendor

Fujitsu

Status
Plugfree Network
Vendor
CVE Published:
11 April 2022

What is CVE-2022-27089?

An unquoted service path vulnerability exists in the Fujitsu PlugFree Network software version 7.3.0.3 and earlier. This flaw can be exploited by a local attacker to escalate their privileges to system level by manipulating the PFNService.exe path. Proper handling and quoting of service paths are crucial to prevent unauthorized gain of elevated access rights.

References

https://hansesecure.de/2022/03/schwachstelle-in-fujitsu-p...
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2022-27089 : Unquoted Service Path Vulnerability in Fujitsu PlugFree Network Software