Read the docs
TI-2022-22905 Aliases CVE-2022-46361GHSA-86vm-3wjc-w52p

Physical access to the WDM enables use of USB device to gain access to the WDM

Priority LOW 32CWE-77Published · Updated

Key facts

Attack vector
Physical
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-77.

Summary

An attacker having physical access to WDM can plug USB device to gain access and execute unwanted commands. A malicious user could enter a system command along with a backup configuration, which could result in the execution of unwanted commands. This issue affects OneWireless all versions up to 322.1 and fixed in version 322.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00288 21st percentileScored 2026-11-07
Fix Fixed OneWireless (Honeywell): 322.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HoneywellOneWireless322.1 to before 322.2322.2Patch availableCNA
  • OneWireless VendorHoneywell Affected 322.1 to before 322.2 Fixed in 322.2 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:honeywell:onewireless_network_wireless_device_manager_firmware:*:*:*:*:*:*:*:*before r322.2VulnerableHoneywell
cpe:2.3:h:honeywell:onewireless_network_wireless_device_manager:-:*:*:*:*:*:*:*not specified by NVDRunning onHoneywell
  • cpe:2.3:o:honeywell:onewireless_network_wireless_device_manager_firmware:*:*:*:*:*:*:*:* Versions before r322.2 Vulnerable ·Honeywell
  • cpe:2.3:h:honeywell:onewireless_network_wireless_device_manager:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Honeywell

Remediation

  • Fix · CNA OneWireless (Honeywell) Fixed in 322.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-46361
  2. 2026-10-03 Alias added: GHSA-86vm-3wjc-w52p

References

Other 1

  • TI-2022-03882 Unauthenticated API allowing an attacker to obtain the information about network resources CVSS 3.1HIGH 7.5
  • TI-2022-21275 Insecure random number used for generating keys for signing Jwt tokens CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences