AssetView: Incorrect permission assignment enables local privilege escalation
Summary
AssetView, AssetView CLOUD and AssetView Cloud + from Hammock Corporation assign incorrect permissions to a critical resource on Windows systems. A local user who can log in to a Windows system running the Management Console or Client Terminal may gain SYSTEM privileges. The attack requires valid local credentials and no user interaction.
Affected
- AssetView before Ver 13.2.7B
- AssetView CLOUD before Ver 13.2.7B (13.2 series) and before Ver 13.3.7 (13.3 series)
- AssetView Cloud + before Ver 2600.201.11
Fixed in
- AssetView: Ver 13.2.7B or later
- AssetView CLOUD: Ver 13.2.7B (13.2 series) or Ver 13.3.7 (13.3 series)
- AssetView Cloud +: Ver 2600.201.11 or later
Workaround
Unknown. The vendor states that no workaround is available and recommends applying the fix.
Exploitation
- No known exploitation in the wild; CISA SSVC assessment: exploitation none, not automatable.
- No public proof-of-concept found at the time of research.
- Local privilege escalation flaws are often exploited once the fix is public.
Our recommendation
- Check whether AssetView, AssetView CLOUD or AssetView Cloud + is in use, including on admin workstations and servers.
- Update to the fixed versions; for AssetView CLOUD, contact the vendor support group to confirm the version.
- Until patched, restrict interactive Windows logons on affected systems to necessary users.
- Monitor AssetView services, binaries and directory permissions for changes, and watch for unexpected processes running as SYSTEM.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- JVN#38664315 advisory jvn.jp
- Hammock vendor notice (Japanese) www.hammock.jp
- JVNDB-2026-000143 jvndb.jvn.jp
- VulDB CVE-2026-101020 vuldb.com
- Vulners EUVD-2026-98361 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:45.
Original description (NVD)
An incorrect permission assignment for critical resource issue exists in AssetView, AssetView CLOUD, and AssetView Cloud +. If this vulnerability is exploited, a local authenticated attacker who can log in to the Windows system where Management Console or Client Terminal for the product is running may gain SYSTEM privileges.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.