title: Honeywell SoftMaster Uncontrolled Search Path Element
description: If an attacker manages to trick a valid user into loading a malicious DLL, the attacker may be able to achieve code execution in Honeywell SoftMaster version 4.51 application’s context and permissions.
problem types: CWE-427: Uncontrolled Search Path Element
affected:
{
product: SoftMaster
vendor: Honeywell
versions:
status: affected, version: 4.51
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
]
solutions: Honeywell has released firmware update packages for the affected products on their website.
More information can be found in the Honeywell Security Notification SN2022-08-31 01 SoftMaster-R4.7
workarounds: Honeywell recommends users with potentially affected products take the following steps to protect themselves:
Update firmware of vulnerable and affected devices.
Isolate systems from the internet or create additional layers of defense to their system from the internet by placing the affected hardware behind a firewall or into a demilitarized zone (DMZ).
If remote connections to the network are required, then users should consider using a VPN or other means to ensure secure remote connections into the network where the device is located.
More information can be found in the Honeywell Security Notification SN2022-08-31 01 SoftMaster-R4.7
