PT-2021-20810 · Fidelis · Fidelis Network/Deception

B0Yd + 1 · Published 2021-06-25 · Updated 2021-09-14 · CVE-2021-35047

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Fidelis Network and Deception versions prior to 9.3.7 Fidelis Network and Deception version 9.4

Description: The issue allows an attacker with user-level access to the Command-Line Interface (CLI) to inject root-level commands into the affected components and neighboring Fidelis components.

Recommendations: For versions prior to 9.3.7, update to version 9.3.7 or later to address the issue. For version 9.4, apply the available patch or update to resolve the vulnerability.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-35047

Affected Products

Fidelis Network/Deception

References · 4

• 🔥 https://securifera.com/blog/2021/06/24/operation-eagle-eye · Exploit
• https://osv.dev/vulnerability/CVE-2021-35047 · Vendor Advisory
• https://support.fidelissecurity.com/hc/en-us/categories/360001842694-Advisories-News-and-Policies · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35047 · Security Note