Vulnerability · Published Sep 16, 2022 · Assigned by icscert
CVE-2022-2333Honeywell SoftMaster Uncontrolled Search Path Element
High 8.8
In plain English
A high-severity uncontrolled search path in SoftMaster from Honeywell. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.4%top 28.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
If an attacker manages to trick a valid user into loading a malicious DLL, the attacker may be able to achieve code execution in Honeywell SoftMaster version 4.51 application’s context and permissions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Honeywell | SoftMaster | 4.51 |
Weakness: CWE-427 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H