Read the docs
TI-2022-21459 Aliases CVE-2022-43702GHSA-g3h3-xh77-5fcf

Incomplete verification of installation file signature

Priority LOW 35CWE-284Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-284.

Summary

When the directory containing the installer does not have sufficiently restrictive file permissions, an attacker can modify (or replace) the installer to execute malicious code.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00169 6th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ArmArm Compiler 5 (AC5), Arm Compiler for Embedded 6 (AC6), Fast Models (FM), Arm Compiler for Embedded FuSA (ACEF), Arm Development Studio (ADS), Arm Forge (AF), Arm Mobile Studio (AMS), DS-5 Development Studio, Fast Models (FM), GNU Toolchain (GT), Keil MDK (KMDK), Mbed Studio (MS)AC5 All Releases, AC6 Releases prior to 6.20, ACEF All Releases, ADS All Releases, AF Releases prior to 22.1, AMS All releases, DS5 All Releases, FM All Releases, GT All Releases, KMDK All Releases, MS All Releases and later—No fix listedCNA
  • Arm Compiler 5 (AC5), Arm Compiler for Embedded 6 (AC6), Fast Models (FM), Arm Compiler for Embedded FuSA (ACEF), Arm Development Studio (ADS), Arm Forge (AF), Arm Mobile Studio (AMS), DS-5 Development Studio, Fast Models (FM), GNU Toolchain (GT), Keil MDK (KMDK), Mbed Studio (MS) VendorArm Affected AC5 All Releases, AC6 Releases prior to 6.20, ACEF All Releases, ADS All Releases, AF Releases prior to 22.1, AMS All releases, DS5 All Releases, FM All Releases, GT All Releases, KMDK All Releases, MS All Releases and later Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:arm:arm_compiler:*:*:*:*:*:*:*:*5.00 – 5.06; 6.00 to before 6.18VulnerableArm
cpe:2.3:a:arm:arm_compiler_for_embedded_fusa:6.16:*:*:*:lts:*:*:*6.16VulnerableArm
cpe:2.3:a:arm:arm_compiler_for_functional_safety:*:*:*:*:*:*:*:*6.6 to before 6.6.5VulnerableArm
cpe:2.3:a:arm:arm_development_studio:*:*:*:*:*:*:*:*all versionsVulnerableArm
cpe:2.3:a:arm:ds_development_studio:*:*:*:*:*:*:*:*5.0.0 – 5.29.3VulnerableArm
cpe:2.3:a:arm:fast_models:*:*:*:*:*:*:*:*all versionsVulnerableArm
  • cpe:2.3:a:arm:arm_compiler:*:*:*:*:*:*:*:* Versions 5.00 – 5.06; 6.00 to before 6.18 Vulnerable ·Arm
  • cpe:2.3:a:arm:arm_compiler_for_embedded_fusa:6.16:*:*:*:lts:*:*:* Versions 6.16 Vulnerable ·Arm
  • cpe:2.3:a:arm:arm_compiler_for_functional_safety:*:*:*:*:*:*:*:* Versions 6.6 to before 6.6.5 Vulnerable ·Arm
  • cpe:2.3:a:arm:arm_development_studio:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Arm
  • cpe:2.3:a:arm:ds_development_studio:*:*:*:*:*:*:*:* Versions 5.0.0 – 5.29.3 Vulnerable ·Arm
  • cpe:2.3:a:arm:fast_models:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Arm

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-43702
  2. 2026-10-03 Alias added: GHSA-g3h3-xh77-5fcf

References

Advisory 1

Other 1

  • TI-2022-21458 Insecure directory permissions on installer files CVSS 3.1HIGH 7.8
  • TI-2020-15125 Arm Compiler 5 through 5.06u6 has an error in a stack protection feature designed to help… CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences