CVE-2022-23922

Published: Feb 24, 2022Modified: Nov 21, 2024

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

WIN-911 2021 R1 and R2 are vulnerable to a permissions misconfiguration that may allow an attacker to locally write files to the Program Announcer directory and elevate permissions whenever the program is executed.

Affected (2)

Products: Win 911: Win 911 2021 R1, Win 911 2021 R2

Win 911

2 products

Win 911 2021 R1

Win 911 2021 R2

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Win 911 Win 911 2021 R1	Version 5.21.10
Win 911 Win 911 2021 R2	Version 5.21.17

Related CWEs

CWE-276

Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

References (4)

https://supportdesk.win911.com/support/solutions/articles/24000074683-win-911-2021-r1-r2-file-permission-vulnerability

Source: ics-cert@hq.dhs.gov

Vendor Advisory

https://www.cisa.gov/uscert/ics/advisories/icsa-22-053-03

Source: ics-cert@hq.dhs.gov

MitigationThird Party AdvisoryUS Government Resource

https://supportdesk.win911.com/support/solutions/articles/24000074683-win-911-2021-r1-r2-file-permission-vulnerability

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://www.cisa.gov/uscert/ics/advisories/icsa-22-053-03

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationThird Party AdvisoryUS Government Resource

Timeline

No history available yet.