2 lines
3.7 KiB
JSON
2 lines
3.7 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Performance Library","vendor":"GIGABYTE","versions":[{"lessThan":"25.12.31.01","status":"affected","version":"0","versionType":"custom"}]}],"source":"twcert@cert.org.tw"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:gigabyte:performance_library:*:*:*:*:*:*:*:*","matchCriteriaId":"90A2231A-3F0C-42F6-B9F9-8B62715C77B3","versionEndExcluding":"25.12.31.01","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Performance Library component of Gigabyte Control Center has an Insecure Deserialization vulnerability. Authenticated local attackers can send a malicious serialized payload to the EasyTune Engine service, resulting in privilege escalation."},{"lang":"es","value":"El componente Performance Library de Gigabyte Control Center tiene una vulnerabilidad de deserialización insegura. Atacantes locales autenticados pueden enviar una carga útil serializada maliciosa al servicio EasyTune Engine, lo que resulta en escalada de privilegios."}],"id":"CVE-2026-4416","lastModified":"2026-06-17T10:56:32.633","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"twcert@cert.org.tw","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"twcert@cert.org.tw","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-4416","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-03-30T15:07:19.795398Z","version":"2.0.3"}}]},"published":"2026-03-30T08:16:18.360","references":[{"source":"twcert@cert.org.tw","tags":["Third Party Advisory"],"url":"https://www.twcert.org.tw/en/cp-139-10806-fbc4a-2.html"},{"source":"twcert@cert.org.tw","tags":["Third Party Advisory"],"url":"https://www.twcert.org.tw/tw/cp-132-10805-a53f6-1.html"}],"sourceIdentifier":"twcert@cert.org.tw","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"twcert@cert.org.tw","type":"Secondary"}]}
|