Medium severity · published May 30, 2023
CVE-2022-43485
Insecure random number used for generating keys for signing Jwt tokens
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
Use of Insufficiently Random Values in Honeywell OneWireless. This vulnerability may allow attacker to manipulate claims in client's JWT token. This issue affects OneWireless version 322.1
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ON
OneWireless · Honeywell
322.1 · source: vendor
ON
Onewireless Network Wireless Device Manager Firmware · Honeywell
before r322.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-43485
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-43485
Product
https://process.honeywell.com/
More from OneWireless
7.5
CVE-2022-4240
Unauthenticated API allowing an attacker to obtain the information about network resources
6.8
CVE-2022-46361
Physical access to the WDM enables use of USB device to gain access to the WDM