title: Honeywell SoftMaster Incorrect Permission Assignment for Critical Resource
description: A local unprivileged attacker may escalate to administrator privileges in Honeywell SoftMaster version 4.51, due to insecure permission assignment.
problem types: CWE-732: Incorrect Permission Assignment for Critical Resource
affected:
{
product: SoftMaster
vendor: Honeywell
versions:
status: affected, version: 4.51
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
version: 3.1
]
solutions: Honeywell has released firmware update packages for the affected products on their website.
More information can be found in the Honeywell Security Notification SN2022-08-31 01 SoftMaster-R4.7
workarounds: Honeywell recommends users with potentially affected products take the following steps to protect themselves:
Update firmware of vulnerable and affected devices.
Isolate systems from the internet or create additional layers of defense to their system from the internet by placing the affected hardware behind a firewall or into a demilitarized zone (DMZ).
If remote connections to the network are required, then users should consider using a VPN or other means to ensure secure remote connections into the network where the device is located.
More information can be found in the Honeywell Security Notification SN2022-08-31 01 SoftMaster-R4.7
