PT-2022-16664 · Fidelis · Fidelis Network/Deception

Published 2022-05-17 · Updated 2022-05-26 · CVE-2022-24389

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Fidelis Network and Deception versions prior to 9.4.5

Description The issue allows an attacker with user-level access to the CLI to inject root-level commands into various Fidelis components, including CommandPost, Collector, Sensor, and Sandbox, as well as neighboring components. This is due to a vulnerability in the rconfig "cert utils".

Recommendations For versions prior to 9.4.5, apply the available patches and updates to address this issue.

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2022-24389

Affected Products

Fidelis Network/Deception

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2022-24389 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24389 · Vendor Advisory
• https://fidelissecurity.zendesk.com/hc/en-us/articles/6211730139411 · Vendor Advisory