CVE-2022-23220

7.8 highEPSS 0.5%

High (7.8) in usbview project usbview. EPSS 0.5% chance of exploitation in the next 30 days.

USBView 2.1 before 2.2 allows some local users (e.g., ones logged in via SSH) to execute arbitrary code as root because certain Polkit settings (e.g., allow_any=yes) for pkexec disable the authentication requirement. Code execution can, for example, use the --gtk-module option. This affects Ubuntu, Debian, and Gentoo.

Severity

CVSS 3.1

7.8 high

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 43% of CVEs (scores of 2026-10-31)
CWE: CWE-306
Published: 2022-01-21
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

usbview_project:usbview

References

http://www.openwall.com/lists/oss-security/2022/01/22/1
https://github.com/gregkh/usbview/commit/bf374fa4e5b9a756789dfd88efa93806a395463b
https://security.gentoo.org/glsa/202310-15
https://www.debian.org/security/2022/dsa-5052
https://www.openwall.com/lists/oss-security/2022/01/21/1

Check your stack JSON