CVE-2022-21958

FAQ

According to the CVSS metric, the attack vector is physical (AV:P). What does that mean for this vulnerability?

An attacker with physical access to a vulnerable system could insert a specially crafted USB device.

Are there additional attack vectors?

This vulnerability could also be exploited through a local attack vector. An attacker authenticated as an administrator on a vulnerable system could mount a specially crafted virtual hard drive (VHD) to exploit the system. This scenario results in a lower CVSS score which is why the primary attack vector is listed as Physical in our documentation.