CVE-2022-27152 - OpenCVE

Roku devices running RokuOS v9.4.0 build 4200 or earlier that uses a Realtek WiFi chip is vulnerable to Arbitrary file modification.

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Adjacent Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:A/AC:L/Au:S/C:N/I:P/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Roku	Wireless Speakers Streaming Stick 4k\+ Express 4k\+ Wireless Subwoofer Roku Os Streambar Pro Roku Tv Ultra Express Streaming Stick 4k Streambar

Configuration 1 [-]

AND

cpe:2.3:o:roku:roku_os:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:roku:express:-:::::::*
	cpe:2.3:h:roku:express_4k\+:-:::::::*
	cpe:2.3:h:roku:roku_tv:-:::::::*
	cpe:2.3:h:roku:streambar:-:::::::*
	cpe:2.3:h:roku:streambar_pro:-:::::::*
	cpe:2.3:h:roku:streaming_stick_4k:-:::::::*
	cpe:2.3:h:roku:streaming_stick_4k\+:-:::::::*
	cpe:2.3:h:roku:ultra:-:::::::*
	cpe:2.3:h:roku:wireless_speakers:-:::::::*
	cpe:2.3:h:roku:wireless_subwoofer:-:::::::*

References

Link	Resource
https://github.com/llamasoft/RootMyRoku	Third Party Advisory
https://support.roku.com/article/12554388937879

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: mitre

Published: 2022-04-08T00:00:00

Updated: 2023-08-29T21:54:02.968184

Reserved: 2022-03-14T00:00:00

Link: CVE-2022-27152

JSON object: View

NVD Information

Status : Modified

Published: 2022-04-08T18:15:09.987

Modified: 2023-08-29T22:15:08.747

Link: CVE-2022-27152

JSON object: View

Redhat Information

No data.

CWE

NVD-CWE-noinfo

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:roku:roku_os:*:*:*:*:*:*:*:*", "matchCriteriaId": "DD2C3EBF-6FC5-4EBC-99D3-40E454B6606D", "versionEndIncluding": "9.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:roku:express:-:*:*:*:*:*:*:*", "matchCriteriaId": "0FF33B1E-AD75-46CB-9AAD-E762D7B2994D", "vulnerable": false}, {"criteria": "cpe:2.3:h:roku:express_4k\\+:-:*:*:*:*:*:*:*", "matchCriteriaId": "32F49C9D-7042-473E-88A7-6121513E92C0", "vulnerable": false}, {"criteria": "cpe:2.3:h:roku:roku_tv:-:*:*:*:*:*:*:*", "matchCriteriaId": "E683FFF5-6B1F-4847-9B50-9C17880870D2", "vulnerable": false}, {"criteria": "cpe:2.3:h:roku:streambar:-:*:*:*:*:*:*:*", "matchCriteriaId": "50520608-A2C8-4D08-971A-D608469904D3", "vulnerable": false}, {"criteria": "cpe:2.3:h:roku:streambar_pro:-:*:*:*:*:*:*:*", "matchCriteriaId": "B7F65E30-6D07-48E7-80DD-E8275443480C", "vulnerable": false}, {"criteria": "cpe:2.3:h:roku:streaming_stick_4k:-:*:*:*:*:*:*:*", "matchCriteriaId": "BF338F83-6265-4774-9D0A-0F3448695179", "vulnerable": false}, {"criteria": "cpe:2.3:h:roku:streaming_stick_4k\\+:-:*:*:*:*:*:*:*", "matchCriteriaId": "57C736A0-122E-4445-8BF2-DA4EC0822575", "vulnerable": false}, {"criteria": "cpe:2.3:h:roku:ultra:-:*:*:*:*:*:*:*", "matchCriteriaId": "98F084EC-AB6A-4488-A6F2-9EAF50281F73", "vulnerable": false}, {"criteria": "cpe:2.3:h:roku:wireless_speakers:-:*:*:*:*:*:*:*", "matchCriteriaId": "8B95508E-9223-478B-A6A9-87E655DD5354", "vulnerable": false}, {"criteria": "cpe:2.3:h:roku:wireless_subwoofer:-:*:*:*:*:*:*:*", "matchCriteriaId": "9A4066B4-DDE3-4937-8B51-7DEFBF3B7D02", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Roku devices running RokuOS v9.4.0 build 4200 or earlier that uses a Realtek WiFi chip is vulnerable to Arbitrary file modification."}, {"lang": "es", "value": "Los dispositivos Roku que ejecutan RokuOS versi\u00f3n v9.4.0 build 4200 o anteriores, que usan un chip WiFi de Realtek son vulnerables a una modificaci\u00f3n arbitraria de archivos"}], "id": "CVE-2022-27152", "lastModified": "2023-08-29T22:15:08.747", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "ADJACENT_NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 2.7, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:A/AC:L/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 5.1, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-04-08T18:15:09.987", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://github.com/llamasoft/RootMyRoku"}, {"source": "cve@mitre.org", "url": "https://support.roku.com/article/12554388937879"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}