Riskcovery

CVE-2021-35049

Command Injection Vulnerability in Fidelis Network and Deception

State
Published
Severity
9.9 Critical
Published
Jun 25, 2021
Updated
Sep 16, 2024
Reserved
Jun 18, 2021

Read the record on cve.org

Description

Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface. The vulnerability could allow a specially crafted HTTP request to execute system commands on the CommandPost and return results in an HTTP response in an authenticated session. The vulnerability is present in Fidelis Network and Deception versions prior to 9.3.7 and in version 9.4. Patches and updates are available to address this vulnerability.

Scores

CVSSScoreVectorSource
3.19.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HFidelis

Weaknesses

Affected Products

ProductVersions
Fidelis NetworkFidelis Cybersecurity
  • Fidelis Network 9.4Affected
  • Fidelis Network to before 9.3.7Affected
Fidelis DeceptionFidelis Cybersecurity
  • Fidelis Deception 9.4Affected
  • Fidelis Deception to before 9.3.7Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.