CVE-2022-2332 - Honeywell SoftMaster Incorrect Permission Assignment for Critical Resource

Back Back to CVE browser

HIGH

Honeywell SoftMaster Incorrect Permission Assignment for Critical Resource

Published Sep 16, 2022

7.8

HIGH

CVSS 3.1

EPSS 0.19%

Description

A local unprivileged attacker may escalate to administrator privileges in Honeywell SoftMaster version 4.51, due to insecure permission assignment.

Affected products

Vendor Honeywell Product SoftMaster Default
n/a
- Version
  4.51
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Honeywell

SoftMaster

n/a

Version	Status	Constraints
4.51	affected	-

Remediation

Vendor solution

Honeywell has released firmware update packages for the affected products on their website. More information can be found in the Honeywell Security Notification SN2022-08-31 01 SoftMaster-R4.7

Weaknesses (1)

CWE-732

Incorrect Permission Assignment

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-34601
Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-256-02
x_refsource_CONFIRMThird Party AdvisoryUS Government Resource
https://www.security.honeywell.com/-/media/Security/Resources/PDF/Product-Warranty/Security_Notification_SN_2019-09-13-02_V4-pdf.pdf
x_refsource_CONFIRMNot Applicable

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-34601		Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-256-02		x_refsource_CONFIRMThird Party AdvisoryUS Government Resource
https://www.security.honeywell.com/-/media/Security/Resources/PDF/Product-Warranty/Security_Notification_SN_2019-09-13-02_V4-pdf.pdf		x_refsource_CONFIRMNot Applicable