CVE-2022-34866

7.8 highEPSS 0.2%

High (7.8) in yrl. EPSS 0.2% chance of exploitation in the next 30 days.

Passage Drive versions v1.4.0 to v1.5.1.0 and Passage Drive for Box version v1.0.0 contain an insufficient data verification vulnerability for interprocess communication. By running a malicious program, an arbitrary OS command may be executed with LocalSystem privilege of the Windows system where the product is running.

Severity

CVSS 3.1

7.8 high

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 10% of CVEs (scores of 2026-10-31)
CWE: CWE-20
Published: 2022-07-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

yrl:passage_drive
yrl:passage_drive_for_box

References

https://jvn.jp/en/jp/JVN23766146/index.html
https://www.yrl.com/fwp_support/info/a1hrbt0000002037.html
https://jvn.jp/en/jp/JVN23766146/index.html
https://www.yrl.com/fwp_support/info/a1hrbt0000002037.html

Check your stack JSON