Riskcovery

CVE-2021-35047

Privileged Command Injection Vulnerability in Fidelis Network and Deception

State
Published
Severity
9.9 Critical
Published
Jun 25, 2021
Updated
Sep 16, 2024
Reserved
Jun 18, 2021

Read the record on cve.org

Description

Vulnerability in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attacker with user level access to the CLI to inject root level commands into the component and neighboring Fidelis components. The vulnerability is present in Fidelis Network and Deception versions prior to 9.3.7 and in version 9.4. Patches and updates are available to address this vulnerability.

Scores

CVSSScoreVectorSource
3.19.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HFidelis

Weaknesses

Affected Products

ProductVersions
Fidelis NetworkFidelis Cybersecurity
  • Fidelis Network 9.4Affected
  • Fidelis Network to before 9.3.7Affected
Fidelis DeceptionFidelis Cybersecurity
  • Fidelis Deception 9.4Affected
  • Fidelis Deception to before 9.3.7Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.