CVE-2022-0486

Privileged Command Injection Vulnerability in Fidelis Network and Deception

Improper file permissions in the CommandPost, Collector, Sensor, and Sandbox components of Fidelis Network and Deception enables an attacker with local, administrative access to the CLI to modify affected files and enable escalation of privileges equivalent to the root user. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability.

Affected

Fidelis Cybersecurity · Fidelis Network · Fidelis Deception

CVSS v3.1 NVD

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 FIDELISSECURITY

4.4 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CVSS v2.0 NVD

7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C

EPSS

0.39% chance of exploitation in the next 30 days, 31st percentile

Published

2022-05-17

Updated

2024-09-16

Proof-of-concept exploits (1)

• henryreed/CVE-2022-04860★ · 2022-06-03

Security advisories

• https://fidelissecurity.zendesk.com/hc/en-us/articles/6211730139411

References

• CVE Record
• NVD entry

Related

• CVE-2022-0997