JVN#38664315
AssetView vulnerable to incorrect permission assignment for critical resource

Overview

AssetView provided by Hammock Corporation contains an incorrect permission assignment for critical resource vulnerability.

Products Affected

• AssetView versions prior to Ver 13.2.7B
• AssetView CLOUD
  • Versions prior to Ver 13.2.7B (13.2 series)
  • Versions prior to Ver 13.3.7 (13.3 series)
• AssetView Cloud + versions prior to Ver 2600.201.11

Description

AssetView provided by Hammock Corporation contains the following vulnerability.

• Incorrect Permission Assignment for Critical Resource (CWE-732)
  • CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 8.5
  • CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Base Score 7.8
  • CVE-2026-101020

Impact

An attacker who can log in to the Windows system where Management Console or Client Terminal for the product is running may gain SYSTEM privileges.

Solution

Update the software or apply the patch
AssetView:
Update the software to the latest version according to the information provided by the developer.
The users who cannot update the software should apply patch according to the information provided by the developer.

AssetView CLOUD:
Contact the developer's support group.

AssetView Cloud +:
Update the software to the latest version according to the information provided by the developer.