Every CVE Search/ Get API key

CVE-2022-23220

USBView 2.1 before 2.2 allows some local users (e.g., ones logged in via SSH) to execute...

7.8 HighFix available

USBView 2.1 before 2.2 allows some local users (e.g., ones logged in via SSH) to execute arbitrary code as root because certain Polkit settings (e.g., allow_any=yes) for pkexec disable the authentication requirement. Code execution can, for example, use the --gtk-module option. This affects Ubuntu, Debian, and Gentoo.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.50%Down 0.9 points since Feb 8, 2022
90%50%10%1%

What each source reports

NVD Score used 7.8

USBView 2.1 before 2.2 allows some local users (e.g., ones logged in via SSH) to execute arbitrary code as root because certain Polkit settings (e.g., allow_any=yes) for pkexec disable the authentication requirement. Code execution can, for example, use the --gtk-module option. This affects Ubuntu, Debian, and Gentoo.

Record
CVE-2022-23220
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.2 HighAV:L/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-306
Updated
2026-11-02
CVE List No score

USBView 2.1 before 2.2 allows some local users (e.g., ones logged in via SSH) to execute arbitrary code as root because certain Polkit settings (e.g., allow_any=yes) for pkexec disable the authentication requirement. Code execution can, for example, use the --gtk-module option. This affects Ubuntu, Debian, and Gentoo.

Record
CVE-2022-23220
Updated
2026-11-02
EUVDEUVD-2022-28309 No score

USBView 2.1 before 2.2 allows some local users (e.g., ones logged in via SSH) to execute arbitrary code as root because certain Polkit settings (e.g., allow_any=yes) for pkexec disable the authentication requirement. Code execution can, for example, use the --gtk-module option. This affects Ubuntu, Debian, and Gentoo.

Record
EUVD-2022-28309
Updated
2026-11-03
GitHub AdvisoriesGHSA-crwr-hcrm-rq6f 7.8

USBView 2.1 before 2.2 allows some local users (e.g., ones logged in via SSH) to execute...

USBView 2.1 before 2.2 allows some local users (e.g., ones logged in via SSH) to execute arbitrary code as root because certain Polkit settings (e.g., allow_any=yes) for pkexec disable the authentication requirement. Code execution can, for example, use the --gtk-module option. This affects Ubuntu, Debian, and Gentoo.

Record
GHSA-crwr-hcrm-rq6f
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-287, CWE-306
Updated
2026-11-02
OSVDEBIAN-CVE-2022-23220 7.8

USBView 2.1 before 2.2 allows some local users (e.g., ones logged in via SSH) to execute arbitrary code as root because certain Polkit settings (e.g., allow_any=yes) for pkexec disable the authentication requirement. Code execution can, for example, use the --gtk-module option. This affects Ubuntu, Debian, and Gentoo.

Record
DEBIAN-CVE-2022-23220
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSVUBUNTU-CVE-2022-23220 7.8

USBView 2.1 before 2.2 allows some local users (e.g., ones logged in via SSH) to execute arbitrary code as root because certain Polkit settings (e.g., allow_any=yes) for pkexec disable the authentication requirement. Code execution can, for example, use the --gtk-module option. This affects Ubuntu, Debian, and Gentoo.

Record
UBUNTU-CVE-2022-23220
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV No score

USBView 2.1 before 2.2 allows some local users (e.g., ones logged in via SSH) to execute arbitrary code as root because certain Polkit settings (e.g., allow_any=yes) for pkexec disable the authentication requirement. Code execution can, for example, use the --gtk-module option. This affects Ubuntu, Debian, and Gentoo.

Record
CVE-2022-23220
Updated
2026-11-02
OSVopenSUSE-SU-2024:11774-1 No score

usbview-3.0-1.1 on GA media

These are all security issues fixed in the usbview-3.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11774-1
Updated
2026-11-02
OSVUSN-5249-1 No score

usbview vulnerability

It was discovered that USBView allowed unprivileged users to run usbview as root. A local attacker could use this vulnerability to gain administrative privileges or cause a denial of service.

Record
USN-5249-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
usbview
Debian:12
 before 2.0-21-g6fe2f4f-2.1
2.0-21-g6fe2f4f-2.1
usbview
Debian:13
 before 2.0-21-g6fe2f4f-2.1
2.0-21-g6fe2f4f-2.1
usbview
Debian:14
 before 2.0-21-g6fe2f4f-2.1
2.0-21-g6fe2f4f-2.1
usbview
Debian:10
 before 2.0-21-g6fe2f4f-2+deb10u1, plus listed versions
2.0-21-g6fe2f4f-2
2.0-21-g6fe2f4f-2+deb10u1
usbview
Debian:11
 before 2.0-21-g6fe2f4f-2+deb11u1, plus listed versions
2.0-21-g6fe2f4f-2
2.0-21-g6fe2f4f-2+deb11u1
usbview
Ubuntu:18.04:LTS
 before 2.0-21-g6fe2f4f-1ubuntu1.1, plus listed versions
2.0-21-g6fe2f4f-1ubuntu1
2.0-21-g6fe2f4f-1ubuntu1.1
usbview
Ubuntu:20.04:LTS
 before 2.0-21-g6fe2f4f-2ubuntu0.20.04.1, plus listed versions
2.0-21-g6fe2f4f-1ubuntu12.0-21-g6fe2f4f-2
2.0-21-g6fe2f4f-2ubuntu0.20.04.1
usbview
Ubuntu:22.04:LTS
 before 2.0-21-g6fe2f4f-2ubuntu1, plus listed versions
2.0-21-g6fe2f4f-2
2.0-21-g6fe2f4f-2ubuntu1
usbview
openSUSE:Tumbleweed
 before 3.0-1.1
3.0-1.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-23220 is a high vulnerability (CVSS 7.8) in Usbview Project Usbview, published January 21, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 43rd percentile. Fixed in usbview 2.0-21-g6fe2f4f-2.1.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open