Read the docs
TI-2022-06592 Aliases CVE-2022-22262GHSA-p79w-3v72-ffh8

ASUS Armoury Crate & Aura Creator Installer之ROG Live Service - Improper Link Resolution Before File Access

Priority LOW 33CWE-59Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

ROG Live Service’s function for deleting temp files created by installation has an improper link resolution before file access vulnerability. Since this function does not validate the path before deletion, an unauthenticated local attacker can create an unexpected symbolic link to system file path, to delete arbitrary system files and disrupt system service.

Why it matters now

EPSS 0.00257 17th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ASUSArmoury Crate & Aura Creator Installer (ROG Live Service)1.2.18.0—No fix listedCNA
  • Armoury Crate & Aura Creator Installer (ROG Live Service) VendorASUS Affected 1.2.18.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:asus:rog_live_service:*:*:*:*:*:*:*:*before 1.3.3.0VulnerableASUS
  • cpe:2.3:a:asus:rog_live_service:*:*:*:*:*:*:*:* Versions before 1.3.3.0 Vulnerable ·ASUS

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-22262
  2. 2026-10-03 Alias added: GHSA-p79w-3v72-ffh8

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences