CVE-2022-37706

enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and the system library function mishandles pathnames that begin with a /dev/.. substring.

CVSS v3.1 NVD

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

5.69% chance of exploitation in the next 30 days, 93rd percentile

Published

2022-12-25

Updated

2025-04-14

Proof-of-concept exploits (9)

• MaherAzzouzi/CVE-2022-37706-LPE-exploit323★ · 2022-09-19
• ECU-10525611-Xander/CVE-2022-377062★ · 2022-09-18
• KaoXx/CVE-2022-377061★ · 2024-09-10
• Rebick/CVEs_exploit0★ · 2026-05-13
• TACTICAL-HACK/CVE-2022-37706-SUID0★ · 2024-07-20
• d3ndr1t30x/CVE-2022-377061★ · 2024-12-10
• junnythemarksman/CVE-2022-377060★ · 2024-06-03
• sanan2004/CVE-2022-377060★ · 2024-08-18
• opensesamedoors/Ubuntu-22-LPE0★ · 2022-09-15

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/ubuntu_enlightenment…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/51180

Security advisories

• https://git.enlightenment.org/enlightenment/enlightenment/commit/cae78cbb169f237862faef12…
• https://git.enlightenment.org/enlightenment/enlightenment/commit/cc7faeccf77fef8b0ae70e31…

References

• CVE Record
• NVD entry

Related

• CVE-2022-37704
• CVE-2022-37705
• CVE-2022-47952
• CVE-2019-12500
• CVE-2026-3888
• CVE-2021-31630