[Japanese]

JVNDB-2026-000143

AssetView vulnerable to incorrect permission assignment for critical resource

Overview

AssetView provided by Hammock Corporation contains the following vulnerability.
  • Incorrect Permission Assignment for Critical Resource (CWE-732) - CVE-2026-101020
Satoru Nagaoka of Cyber Defense Institute, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

CVSS V3 Severity:
Base Metrics 7.8 (High) [IPA Score]
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High
CVSS v4 Severity
Base Metrics: 8.5 (High) [IPA Score]
  • Access Vector (AV): Local
  • Attack Complexity (AC): Low
  • Attack Requirements (AT): None
  • Privileges Required (PR): Low
  • User Interaction (UI): None
    • Vulnerable System Impact
  • Confidentiality Impact (VC): High
  • Integrity Impact (VI): High
  • Availability Impact (VA): High
    • Subsequent System Impact
  • Confidentiality Impact (SC): None
  • Integrity Impact (SI): None
  • Availability Impact (SA): None
Affected Products


Hammock Corporation
  • AssetView versions prior to Ver 13.2.7B
  • AssetView CLOUD Versions prior to Ver 13.2.7B (13.2 series)
  • AssetView CLOUD Versions prior to Ver 13.3.7 (13.3 series)
  • AssetView Cloud + versions prior to Ver 2600.201.11

Impact

An attacker who can log in to the Windows system where Management Console or Client Terminal for the product is running may gain SYSTEM privileges.
Solution

[Update the software or apply the patch]
AssetView:
Update the software to the latest version according to the information provided by the developer.
The users who cannot update the software should apply patch according to the information provided by the developer.

AssetView CLOUD:
Contact the developer's support group.

AssetView Cloud +:
Update the software to the latest version according to the information provided by the developer.
Vendor Information

Hammock Corporation
CWE (What is CWE?)

  1. No Mapping(CWE-Other) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2026-101020
References

  1. JVN : JVN#38664315
Revision History

  • [2026/10/13]
      Web page was published

Date Public2026/10/13
Date First Published2026/10/13
Date Last Updated2026/10/13