CVE-2022-23220

USBView 2.1 before 2.2 allows some local users (e.g., ones logged in via SSH) to execute arbitrary code as root because certain Polkit settings (e.g., allow_any=yes) for pkexec disable the authentication requirement. Code execution can, for example, use the --gtk-module option. This affects Ubuntu, Debian, and Gentoo.

• CWE-306

• http://www.openwall.com/lists/oss-security/2022/01/22/1Mailing List, Third Party Advisory
• https://github.com/gregkh/usbview/commit/bf374fa4e5b9a756789dfd88efa93806a395463bPatch, Third Party Advisory
• https://security.gentoo.org/glsa/202310-15Third Party Advisory
• https://www.debian.org/security/2022/dsa-5052Third Party Advisory
• https://www.openwall.com/lists/oss-security/2022/01/21/1Exploit, Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/01/22/1Mailing List, Third Party Advisory
• https://github.com/gregkh/usbview/commit/bf374fa4e5b9a756789dfd88efa93806a395463bPatch, Third Party Advisory
• https://security.gentoo.org/glsa/202310-15Third Party Advisory
• https://www.debian.org/security/2022/dsa-5052Third Party Advisory
• https://www.openwall.com/lists/oss-security/2022/01/21/1Exploit, Mailing List, Patch, Third Party Advisory

Published

Jan 21, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-23204Adobe Premiere Rush versions 2.0 and earlier are affected by…5.5
• CVE-2022-23205Adobe Photoshop versions 22.5.6 (and earlier)and 23.2.2 (and…7.8
• CVE-2022-23206In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.…7.5
• CVE-2022-2321Improper Restriction of Excessive Authentication Attempts in…9.8
• CVE-2022-23218The deprecated compatibility function svcunix_create in the …9.8
• CVE-2022-23219The deprecated compatibility function clnt_create in the sun…9.8
• CVE-2022-23221H2 Console before 2.1.210 allows remote attackers to execute…9.8
• CVE-2022-23222kernel/bpf/verifier.c in the Linux kernel through 5.15.14 al…7.8
• CVE-2022-23223On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint exis…7.5
• CVE-2022-23227NUUO NVRmini2 through 3.11 allows an unauthenticated attacke…9.8
• CVE-2022-23228Pexip Infinity before 27.0 has improper WebRTC input validat…7.5
• CVE-2022-2323Improper neutralization of special elements used in a user i…8.8