PT-2022-12462 · Controlup · Controlup Real-Time Agent

James Burton + 1 · Published 2022-01-04 · Updated 2022-01-14 · CVE-2021-45912

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Controlup Real-Time Agent versions prior to 8.5

Description The issue concerns an unauthenticated Named Pipe channel in the Controlup Real-Time Agent, potentially allowing an attacker to run OS commands via the ProcessActionRequest WCF method.

Recommendations For versions prior to 8.5, update to version 8.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the Named Pipe channel to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-45912

Affected Products

Controlup Real-Time Agent

References · 5

• https://osv.dev/vulnerability/CVE-2021-45912 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45912 · Security Note
• https://controlup.com/security/security-advisory-local-privilege-escalation · Vendor Advisory
• https://controlup.com · Note
• https://t.me/cibsecurity/34923 · Telegram Post