CVE-2022-24388

Name of the Vulnerable Software and Affected Versions Fidelis Network and Deception versions prior to 9.4.5

Description The issue allows an attacker with user-level access to the CLI to inject root-level commands into various Fidelis components, including CommandPost, Collector, Sensor, and Sandbox, as well as neighboring components. This is due to a vulnerability in the rconfig "date" feature. Patches and updates are available to address this issue.

Recommendations For versions prior to 9.4.5, update to version 9.4.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the rconfig "date" feature to minimize the risk of exploitation.