What’s Vulnerable › Vulnerabilities

CVE-2022-43701: Insecure directory permissions on installer files

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-07-27 · updated 2026-06-17
• Weakness: CWE-276

Description

When the installation directory does not have sufficiently restrictive file permissions, an attacker can modify files in the installation directory to cause execution of malicious code.

Affected products

• Arm Compiler: from 5.00 through 5.06; from 6.00 before 6.20 — fixed in 6.20
• Arm Compiler For Embedded Fusa: 6.16
• Arm Compiler For Functional Safety: 6.6
• Arm Development Studio: all versions
• Arm Mobile Studio: all versions
• Arm Ds Development Studio: from 5.0.0 through 5.29.3
• Arm Fast Models: all versions
• Arm Gnu Toolchain: all versions
• Arm Keil Mdk: all versions
• Arm Linaro Forge: before 22.1 — fixed in 22.1
• Arm Mbed Studio: all versions

How to fix

Upgrade to a fixed version: Arm Compiler 6.20; Arm Linaro Forge 22.1. Check the vendor advisory for mitigations.

References

• https://developer.arm.com/documentation/ka005596/latest
• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00930.html
• https://developer.arm.com/documentation/ka005596/latest
• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00930.html

Get alerted when CVE-2022-43701 or the next vulnerability affects your stack