What’s Vulnerable › Vulnerabilities

CVE-2022-43702: Incomplete verification of installation file signature

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-07-27 · updated 2026-06-17
• Weakness: CWE-284

Description

When the directory containing the installer does not have sufficiently restrictive file permissions, an attacker can modify (or replace) the installer to execute malicious code.

Affected products

• Arm Compiler: from 5.00 through 5.06; from 6.00 before 6.18 — fixed in 6.18
• Arm Compiler For Embedded Fusa: 6.16
• Arm Compiler For Functional Safety: from 6.6 before 6.6.5 — fixed in 6.6.5
• Arm Development Studio: all versions
• Arm Ds Development Studio: from 5.0.0 through 5.29.3
• Arm Fast Models: all versions

How to fix

Upgrade to a fixed version: Arm Compiler 6.18; Arm Compiler For Functional Safety 6.6.5. Check the vendor advisory for mitigations.

References

• https://developer.arm.com/documentation/ka005596/latest
• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00930.html
• https://developer.arm.com/documentation/ka005596/latest
• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00930.html

Get alerted when CVE-2022-43702 or the next vulnerability affects your stack