ASSA ABLOY Visionline CVE-2026-3315
MEDIUMSeverity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:L/U:Clear
Local access with low-privilege required; no user interaction; scope changed to reflect subsequent system impact from 4.0 vector; high integrity from VI:H in vulnerable system.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Incorrect Default Permissions, : Execution with Unnecessary Privileges, : Incorrect Permission Assignment for Critical Resource vulnerability in ASSA ABLOY Visionline on Windows allows Configuration/Environment Manipulation.This issue affects Visionline: from 1.0 before 1.33.
AnalysisAI
Privilege escalation in ASSA ABLOY Visionline on Windows (versions 1.0 through 1.32) stems from incorrect default file and directory permissions on critical resources, allowing a locally authenticated low-privileged user to manipulate system configuration or environment settings. The vulnerability combines CWE-250 (Execution with Unnecessary Privileges) with incorrect permission assignment, enabling an attacker with prior local access to elevate effective control over an access management system that governs physical room access in hospitality environments. No public exploit code has been identified and EPSS probability is near-zero (0.01%); however, the high integrity impact on the Visionline system is notable given its role in physical access control.
Technical ContextAI
ASSA ABLOY Visionline (marketed under the VingCard brand) is a physical access control and electronic key management platform deployed in hotels and hospitality venues, running exclusively on Windows per the CPE cpe:2.3:a:assaabloy:visionline:*:*:*:*:*:*:*:*. The root cause is CWE-250 (Execution with Unnecessary Privileges), compounded by incorrect default permissions on critical installation resources - likely service binaries, DLL paths, or configuration files within the Visionline installation directory. On Windows, when a high-privilege service process reads from directories writable by lower-privileged users, standard local privilege escalation techniques such as DLL hijacking, binary planting, or configuration tampering become viable. The CVSS 4.0 metric AT:P (Attack Requirements: Present) indicates a specific prerequisite condition must exist - consistent with the misconfigured permissions being present only in default or standard installation layouts, not all possible configurations.
RemediationAI
Upgrade to Visionline version 1.33 or later, which resolves the incorrect default permissions and unnecessary privilege execution identified in this advisory; version 1.33 is the explicit fix boundary per the NVD description. Obtain the update package and specific installation instructions from the vendor advisory at https://www.vingcard.com/en/service-and-support/product-security-center/hospitality-product-security-advisories. As compensating controls prior to patching, audit Windows file and directory permissions on the Visionline installation directory using icacls to identify and remove write access for non-administrative or standard user accounts - restricting inheritance to administrators and the SYSTEM account only. Additionally, restrict local and RDP logon rights on the Visionline server to the minimum necessary personnel via Group Policy (User Rights Assignment), and configure Visionline services to run under least-privilege service accounts rather than SYSTEM or LocalSystem where supported. Note that permission hardening may require retesting Visionline functionality, as tightening permissions beyond vendor defaults could affect service startup behavior.
Same weakness CWE-250 – Execution with Unnecessary Privileges
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today