Description
An incorrect permission assignment for critical resource issue exists in AssetView, AssetView CLOUD, and AssetView Cloud +. If this vulnerability is exploited, a local authenticated attacker who can log in to the Windows system where Management Console or Client Terminal for the product is running may gain SYSTEM privileges.
Published: 2026-10-13
Score: 8.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation to SYSTEM
Action: Apply Patch
AI Analysis

Impact

The AssetView family of products from Hammock Corporation suffers from an incorrect permission assignment flaw. A local user authenticated on the Windows host that runs the Management Console or Client Terminal can elevate to SYSTEM, granting full control of the host, including configuration and data. This flaw is a CWE-732: Incorrect Permission Assignment.

Affected Systems

Hammock Corporation AssetView, AssetView CLOUD, and AssetView Cloud +. Version information is not specified, so all released versions may be impacted until an update is issued by the vendor.

Risk and Exploitability

The vulnerability scores a CVSS of 8.5, indicating high severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog. Exploitation requires local authenticated access to the host running the affected component, meaning an attacker must have a user credential on that machine. The risk is confined to environments where local accounts can log in to those hosts.

Generated by OpenCVE AI on October 13, 2026 at 12:24 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest security update or patch released by Hammock Corporation for AssetView, AssetView CLOUD, and AssetView Cloud +.
  • Configure the system to restrict privileges for accounts that run the Management Console or Client Terminal, ensuring only the necessary minimum permissions are granted.
  • Prevent local user accounts with broad access from logging into the Windows hosts that host the console or client terminal, or isolate those services on dedicated, hardened machines.

Generated by OpenCVE AI on October 13, 2026 at 12:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
Title Local Authenticated Privilege Escalation via Incorrect Permission Assignment in Hammock AssetView

Tue, 13 Oct 2026 09:00:00 +0000

Type Values Removed Values Added
Description An incorrect permission assignment for critical resource issue exists in AssetView, AssetView CLOUD, and AssetView Cloud +. If this vulnerability is exploited, a local authenticated attacker who can log in to the Windows system where Management Console or Client Terminal for the product is running may gain SYSTEM privileges.
Weaknesses CWE-732
References
Metrics cvssV3_0

{'score': 7.8, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.5, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: jpcert

Published:

Updated: 2026-10-13T08:40:15.589Z

Reserved: 2026-09-28T03:09:47.900Z

Link: CVE-2026-101020

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-13T09:17:13.257

Modified: 2026-10-13T14:31:20.750

Link: CVE-2026-101020

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T12:30:07Z

Weaknesses
  • CWE-732

    Incorrect Permission Assignment for Critical Resource