CVE-2022-46361— Physical access to the WDM enables use of USB device to gain access to the WDM
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2022-46361
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Physical access to the WDM enables use of USB device to gain access to the WDM
Source: NVD (National Vulnerability Database)
Vulnerability Description
An attacker having physical access to WDM can plug USB device to gain access and execute unwanted commands. A malicious user could enter a system command along with a backup configuration, which could result in the execution of unwanted commands. This issue affects OneWireless all versions up to 322.1 and fixed in version 322.2.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
在命令中使用的特殊元素转义处理不恰当(命令注入)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Honeywell OneWireless 操作系统命令注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Honeywell OneWireless是美国霍尼韦尔（Honeywell）公司的一种工业无线网状网络，能够同时支持 ISA100 Wireless*(IEC 62734)、WirelessHART (IEC 62591) 现场仪器（变送器、执行器等）、Wi-Fi 设备和基于以太网/IP 的设备。 Honeywell OneWireless 322.1版本及之前版本存在安全漏洞。攻击者利用该漏洞可以插入USB设备以获得访问权限并执行命令。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Honeywell | OneWireless | 322.1 ~ 322.2 | - |
II. Public POCs for CVE-2022-46361
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-46361
请登录查看更多情报信息。
Same Patch Batch · Honeywell · 2023-05-30 · 3 CVEs total
| CVE-2022-4240 | 6.5 MEDIUM | Unauthenticated API allowing an attacker to obtain the information about network resources |
| CVE-2022-43485 | 6.2 MEDIUM | Insecure random number used for generating keys for signing Jwt tokens |
IV. Related Vulnerabilities
Same vendor: Honeywell
- CVE-2026-4272
CVE-2026-4272 - Bluetooth Remote Execution of System Command - CVE-2026-3611
Honeywell IQ4x BMS Controller Missing authentication for cri - CVE-2026-1670
Honeywell CCTV Products Missing Authentication for Critical - CVE-2021-47868
WIN-PACK PRO 4.8 - 'WPCommandFileService' Unquoted Service P - CVE-2021-47866
WIN-PACK PRO 4.8 - 'GuardTourService' Unquoted Service Path
Same weakness: CWE-77
- CVE-2026-8210
aandrew-me tgpt Update helper.go helper.Update command injec - CVE-2026-42258
net-imap: Command Injection via unvalidated Symbol inputs - CVE-2026-42453
Termix: Command injection in extractArchive/compressFiles vi - CVE-2026-42271
LiteLLM: Authenticated command execution via MCP stdio test - CVE-2026-41500
electerm has Command Injection Vulnerability via runMac func
V. Comments for CVE-2022-46361
No comments yet