What’s Vulnerable › Vulnerabilities

CVE-2022-23104: WIN-911 2021 Incorrect Default Permissions

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-02-24 · updated 2026-06-17
• Weakness: CWE-276

Description

WIN-911 2021 R1 and R2 are vulnerable to a permissions misconfiguration that may allow an attacker to locally write files to the program Operator Workspace directory, which holds DLL files and executables. A low-privilege attacker could write a malicious DLL file to the Operator Workspace directory to achieve privilege escalation and the permissions of the user running the program.

Affected products

• Win-911 2021 R1: 5.21.10
• Win-911 2021 R2: 5.21.17

References

• https://supportdesk.win911.com/support/solutions/articles/24000074683-win-911-2021-r1-r2-file-permission-vulnerability
• https://www.cisa.gov/uscert/ics/advisories/icsa-22-053-03
• https://supportdesk.win911.com/support/solutions/articles/24000074683-win-911-2021-r1-r2-file-permission-vulnerability
• https://www.cisa.gov/uscert/ics/advisories/icsa-22-053-03

Get alerted when CVE-2022-23104 or the next vulnerability affects your stack