PT-2022-4180 · Device42 · Device42 Cmdb

Published 2022-08-12 · Updated 2022-08-18 · CVE-2022-1399

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Device42 CMDB versions 18.01.00 and prior versions.

Description The issue is related to an Argument Injection or Modification vulnerability in the Discovery component of Device42 CMDB, specifically in the "Change Secret" username field. This allows a local attacker to run arbitrary code on the appliance with root privileges. The vulnerability can also be exploited remotely by creating an auto-discovery task, potentially allowing an attacker to execute arbitrary code.

Recommendations For Device42 CMDB versions 18.01.00 and prior, update to a version that includes a fix for this issue to prevent arbitrary code execution with root privileges. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

BDU:2022-05027

CVE-2022-1399

Affected Products

Device42 Cmdb

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-1399 · Security Note
• https://bdu.fstec.ru/vul/2022-05027 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1399 · Vendor Advisory
• https://bitdefender.com/files/News/CaseStudies/study/422/Bitdefender-PR-Whitepaper-Device42-creat6295-en-EN.pdf · Note
• https://t.me/true_secator/3287 · Telegram Post
• https://bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance · Note