Read the docs
TI-2022-21458 Aliases CVE-2022-43701GHSA-f7p2-4f5g-hfv9

Insecure directory permissions on installer files

Priority LOW 35CWE-276Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

When the installation directory does not have sufficiently restrictive file permissions, an attacker can modify files in the installation directory to cause execution of malicious code.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00182 7th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ArmArm Compiler 5 (AC5), Arm Compiler for Embedded 6 (AC6), Fast Models (FM), Arm Compiler for Embedded FuSA (ACEF), Arm Development Studio (ADS), Arm Forge (AF), Arm Mobile Studio (AMS), DS-5 Development Studio, Fast Models (FM), GNU Toolchain (GT), Keil MDK (KMDK), Mbed Studio (MS)AC5 All Releases, AC6 Releases prior to 6.20, ACEF All Releases, ADS All Releases, AF Releases prior to 22.1, AMS All releases, DS5 All Releases, FM All Releases, GT All Releases, KMDK All Releases, MS All Releases and later—No fix listedCNA
  • Arm Compiler 5 (AC5), Arm Compiler for Embedded 6 (AC6), Fast Models (FM), Arm Compiler for Embedded FuSA (ACEF), Arm Development Studio (ADS), Arm Forge (AF), Arm Mobile Studio (AMS), DS-5 Development Studio, Fast Models (FM), GNU Toolchain (GT), Keil MDK (KMDK), Mbed Studio (MS) VendorArm Affected AC5 All Releases, AC6 Releases prior to 6.20, ACEF All Releases, ADS All Releases, AF Releases prior to 22.1, AMS All releases, DS5 All Releases, FM All Releases, GT All Releases, KMDK All Releases, MS All Releases and later Fixed in — No fix listed CNA

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:a:arm:arm_compiler:*:*:*:*:*:*:*:*5.00 – 5.06; 6.00 to before 6.20VulnerableArm
cpe:2.3:a:arm:arm_compiler_for_embedded_fusa:6.16:*:*:*:lts:*:*:*6.16VulnerableArm
cpe:2.3:a:arm:arm_compiler_for_functional_safety:6.6:*:*:*:*:*:*:*6.6VulnerableArm
cpe:2.3:a:arm:arm_development_studio:*:*:*:*:*:*:*:*all versionsVulnerableArm
cpe:2.3:a:arm:arm_mobile_studio:*:*:*:*:*:*:*:*all versionsVulnerableArm
cpe:2.3:a:arm:ds_development_studio:*:*:*:*:*:*:*:*5.0.0 – 5.29.3VulnerableArm
cpe:2.3:a:arm:fast_models:*:*:*:*:*:*:*:*all versionsVulnerableArm
cpe:2.3:a:arm:gnu_toolchain:*:*:*:*:*:*:*:*all versionsVulnerableArm
cpe:2.3:a:arm:keil_mdk:*:*:*:*:*:*:*:*all versionsVulnerableArm
cpe:2.3:a:arm:linaro_forge:*:*:*:*:*:*:*:*before 22.1VulnerableArm
  • cpe:2.3:a:arm:arm_compiler:*:*:*:*:*:*:*:* Versions 5.00 – 5.06; 6.00 to before 6.20 Vulnerable ·Arm
  • cpe:2.3:a:arm:arm_compiler_for_embedded_fusa:6.16:*:*:*:lts:*:*:* Versions 6.16 Vulnerable ·Arm
  • cpe:2.3:a:arm:arm_compiler_for_functional_safety:6.6:*:*:*:*:*:*:* Versions 6.6 Vulnerable ·Arm
  • cpe:2.3:a:arm:arm_development_studio:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Arm
  • cpe:2.3:a:arm:arm_mobile_studio:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Arm
  • cpe:2.3:a:arm:ds_development_studio:*:*:*:*:*:*:*:* Versions 5.0.0 – 5.29.3 Vulnerable ·Arm
  • cpe:2.3:a:arm:fast_models:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Arm
  • cpe:2.3:a:arm:gnu_toolchain:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Arm
  • cpe:2.3:a:arm:keil_mdk:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Arm
  • cpe:2.3:a:arm:linaro_forge:*:*:*:*:*:*:*:* Versions before 22.1 Vulnerable ·Arm
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:arm:mbed_studio:*:*:*:*:*:*:*:*all versionsVulnerableArm
  • cpe:2.3:a:arm:mbed_studio:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Arm

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-43701
  2. 2026-10-03 Alias added: GHSA-f7p2-4f5g-hfv9

References

Advisory 1

Other 1

  • TI-2022-21459 Incomplete verification of installation file signature CVSS 3.1HIGH 7.8
  • TI-2020-15125 Arm Compiler 5 through 5.06u6 has an error in a stack protection feature designed to help… CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences