CVE-2022-25943
Published: 09 March 2022
Summary
CVE-2022-25943 is a high-severity Incorrect Default Permissions (CWE-276) vulnerability in Kingsoft Wps Office. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 6.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The vulnerability tracked as CVE-2022-25943 is an instance of CWE-276 in which the WPS Office for Windows installer, prior to version 11.2.0.10258, fails to set correct access-control lists on the directory containing the service executable. The resulting weak permissions allow unauthorized modification of files in that location. The flaw carries a CVSS 3.1 base score of 7.8 and is exploitable by a local attacker.
A low-privileged local user can replace or add binaries within the service directory and trigger execution under the service account, thereby obtaining full control over confidentiality, integrity, and availability on the affected system. Public proof-of-concept code demonstrating local privilege escalation has been published on GitHub.
The vendor addressed the issue in the August 2021 release of WPS Office 11.2.0.10258, which configures proper ACLs during installation. Japanese vulnerability information sources (JVN) and the vendor advisory both recommend upgrading to the fixed version. The associated EPSS score has remained flat at 0.0986 since disclosure, indicating no material increase in observed exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-30518
Vulnerability details
The installer of WPS Office for Windows versions prior to v11.2.0.10258 fails to configure properly the ACL for the directory where the service program is installed.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Access control policy can specify and enforce secure default permissions for resources.
Guides setting of default permissions to the minimum required level.
Establishes requirements for appropriate default permissions on system resources as part of configuration management.
Baseline establishment and updates on install/upgrade ensure correct default permissions rather than insecure ones.
Requiring the most restrictive settings instead of defaults prevents incorrect default permissions on resources.
Requires documented processes that include setting and maintaining correct default permissions for configuration items.
Requires addressing secure default permissions in physical and environmental protection controls.
Tailoring explicitly overrides or scopes default permission assignments in the baseline to match the system's actual risk and operational needs.