Skip to content
OpenAdvisories
Critical ICSA-23-075-06 3 CVEs

Honeywell OneWireless Wireless Device Manager

Published Apr 3, 2023 · Updated Apr 3, 2023

Vendor: Honeywell Product: OneWireless WDM

Summary

Successful exploitation of these vulnerabilities could disclose sensitive information, allow privilege escalation, or allow remote code execution.

Vulnerabilities 3

  • Medium 6.9
    CVE-2022-46361

    Physical access to the WDM enables use of USB device to gain access to the WDM

    An attacker having physical access to WDM can plug USB device to gain access and execute unwanted commands. A malicious user could enter a system command along with a backup configuration, which could result in the execution of unwanted commands. This issue a…

    Honeywell OneWireless ICS / OT
  • Medium 6.5
    CVE-2022-4240

    Unauthenticated API allowing an attacker to obtain the information about network resources

    Missing Authentication for Critical Function vulnerability in Honeywell OneWireless allows Authentication Bypass. This issue affects OneWireless version 322.1

    Honeywell OneWireless ICS / OT
  • Medium 6.2
    CVE-2022-43485

    Insecure random number used for generating keys for signing Jwt tokens

    Use of Insufficiently Random Values in Honeywell OneWireless. This vulnerability may allow attacker to manipulate claims in client's JWT token. This issue affects OneWireless version 322.1

    Honeywell OneWireless ICS / OT

Revision history

  1. #1

    CSAF Creation Date

References