CVE-2022-24389
Authenticated Privileged Command Injection Vulnerability in Fidelis Network and Deception
- State
- Published
- Severity
- 8.8 High
- Published
- May 17, 2022
- Updated
- Sep 16, 2024
- Reserved
- Feb 3, 2022
Description
Vulnerability in rconfig “cert_utils” enables an attacker with user level access to the CLI to inject root level commands into Fidelis Network and Deception CommandPost, Collector, Sensor, and Sandbox components as well as neighboring Fidelis components. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | Fidelis |
Weaknesses
- CWE-78 OS Command Injection
Affected Products
| Product | Versions |
|---|---|
Fidelis NetworkFidelis Cybersecurity |
|
Fidelis DeceptionFidelis Cybersecurity |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.