CVE-2022-38604
📋 TL;DR
CVE-2022-38604 is an arbitrary file deletion vulnerability in Wacom tablet drivers for Windows. Attackers can delete arbitrary files on affected systems, potentially causing data loss or system instability. Users of Wacom tablets with vulnerable driver versions on Windows are affected.
💻 Affected Systems
- Wacom Tablet Driver
📦 What is this software?
Driver by Wacom
Driver by Wacom
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through deletion of critical system files, leading to OS corruption, data loss, or denial of service.
Likely Case
Targeted deletion of user files, configuration files, or application data causing data loss and disruption.
If Mitigated
Limited impact with proper file permissions and user account controls in place, potentially only affecting user-writable areas.
🎯 Exploit Status
Exploit requires local execution or social engineering to run malicious code. Public proof-of-concept available on GitHub.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.3.47-1 and later
Vendor Advisory: https://www.wacom.com/en-us/support/product-support/drivers
Restart Required: Yes
Instructions:
1. Visit Wacom driver download page. 2. Download latest driver version 6.3.47-1 or newer. 3. Run installer. 4. Restart system when prompted.
🔧 Temporary Workarounds
Remove Wacom Driver
windowsUninstall vulnerable Wacom driver if tablet functionality is not required
Control Panel > Programs > Uninstall a program > Select Wacom Tablet Driver > Uninstall
Restrict File Permissions
windowsApply strict file permissions to limit deletion capabilities
icacls "C:\Program Files\Tablet\Wacom" /deny Everyone:(D)
🧯 If You Can't Patch
- Disconnect Wacom tablets and remove driver if not essential
- Implement application whitelisting to prevent unauthorized executables
🔍 How to Verify
Check if Vulnerable:
Check Wacom driver version in Control Panel > Programs and Features. If version is 6.3.46-1 or earlier, system is vulnerable.Check Version:
wmic product where "name like '%Wacom%'" get versionVerify Fix Applied:
Verify driver version is 6.3.47-1 or newer after update. Test file deletion functionality if possible.📡 Detection & Monitoring
Log Indicators:
- Unexpected file deletion events in Windows Event Logs (Security/System)
- Wacom driver process spawning unusual file operations
Network Indicators:
- No network indicators - local vulnerability
SIEM Query:
EventID=4663 AND ObjectName="*" AND AccessMask="0x10000" AND ProcessName="*Wacom*"