Medium severity · published May 30, 2023
CVE-2022-43485
Use of Insufficiently Random Values in Honeywell OneWireless
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
Use of Insufficiently Random Values in Honeywell OneWireless. This vulnerability may allow attacker to manipulate claims in client's JWT token. This issue affects OneWireless version 322.1
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ON
Onewireless Network Wireless Device Manager Firmware · Honeywell
before r322.2 · source: NVD
Affected product
ON
Onewireless Network Wireless Device Manager Firmware
Honeywell
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-43485
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-43485
Product
https://process.honeywell.com/
More from Onewireless Network Wireless Device Manager Firmware
7.5
CVE-2022-4240
Missing Authentication for Critical Function vulnerability in Honeywell OneWireless allows Authentication Bypass. This issue affects OneWireless version 322.1
6.8
CVE-2022-46361
An attacker having physical access to WDM can plug USB device to gain access and execute unwanted commands