Read the docs
TI-2022-11419 Aliases CVE-2022-28792GHSA-pw9r-x35f-xg5m

Uncontrolled search path in Samsung Gear IconX PC Manager

Priority LOW 34CWE-427Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-427.

Summary

DLL hijacking vulnerability in Gear IconX PC Manager prior to version 2.1.220405.51 allows attacker to execute arbitrary code. The patch adds proper absolute path to prevent dll hijacking.

Why it matters now

EPSS 0.00249 16th percentileScored 2026-11-07
Fix Fixed Gear IconX PC Manager (Samsung Mobile): 2.1.220405.51

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SamsungGear IconX PC Manager- to before 2.1.220405.512.1.220405.51Patch availableCNA
  • Gear IconX PC Manager VendorSamsung Affected - to before 2.1.220405.51 Fixed in 2.1.220405.51 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:samsung:gear_iconx_pc_manager:*:*:*:*:*:*:*:*before 2.1.220405.51VulnerableSamsung
  • cpe:2.3:a:samsung:gear_iconx_pc_manager:*:*:*:*:*:*:*:* Versions before 2.1.220405.51 Vulnerable ·Samsung

Remediation

  • Fix · CNA Gear IconX PC Manager (Samsung Mobile) Fixed in 2.1.220405.51

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-28792
  2. 2026-10-03 Alias added: GHSA-pw9r-x35f-xg5m

References

Advisory 1

  • TI-2022-18903 Insufficient verification of data authenticity in Samsung Gear IconX PC Manager CVSS 3.1HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences