Main Vulnerability Database Vulnerabilities #VU60802

Incorrect default permissions in WIN-911 2021 R1 and WIN-911 2021 R2 - CVE-2022-23922

Published: February 23, 2022

Vulnerability identifier: #VU60802

CSH Severity: Low

CVSS v4: 5.2 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-23922

CWE-ID: CWE-276

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions. A local user can write files to the Program Announcer directory and elevate permissions whenever the program is executed.

Affected software

WIN-911 2021 R1
WIN-911 2021 R2

How to mitigate CVE-2022-23922

Install updates from vendor's website.

External References

https://ics-cert.us-cert.gov/advisories/icsa-22-053-03
https://supportdesk.win911.com/support/solutions/articles/24000074683-win-911-2021-r1-r2-file-permission-vulnerability

Related Security Bulletins