PT-2022-16664
CVE-2022-24389
·
Published
2022-05-17
·
Updated
2022-05-26
Description by
CVSS 2.0
9.0
HighMetricsAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions
Fidelis Network and Deception versions prior to 9.4.5
Description
The issue allows an attacker with user-level access to the CLI to inject root-level commands into various Fidelis components, including CommandPost, Collector, Sensor, and Sandbox, as well as neighboring components. This is due to a vulnerability in the rconfig "cert utils".
Recommendations
For versions prior to 9.4.5, apply the available patches and updates to address this issue.
Found an issue in the description? Have something to add? Feel free to write us 👾