Honeywell Onewireless Network Wireless Device Manager Firmware vulnerabilities

3 CVEs affecting Honeywell Onewireless Network Wireless Device Manager Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-4240, published 2023-05-30.

More from Honeywell.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-4240, published 2023-05-30. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Missing Authentication for Critical Function vulnerability in Honeywell OneWireless allows Authentication Bypass. This issue affects OneWireless version 322.1
• CVE-2022-43485, published 2023-05-30. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. Use of Insufficiently Random Values in Honeywell OneWireless. This vulnerability may allow attacker to manipulate claims in client's JWT token. This issue affects OneWireless version 322.1
• CVE-2022-46361, published 2023-05-30. Medium severity, CVSS 6.8. EPSS: 0.3% chance of exploitation in the next 30 days. An attacker having physical access to WDM can plug USB device to gain access and execute unwanted commands. A malicious user could enter a system command along with a backup configuration, which…