CVE-2021-35049

CRITICAL

Fidelis Network & Deception <9.3.7, 9.4 - Command Injection

Title source: llm
STIX 2.1

Description

Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface. The vulnerability could allow a specially crafted HTTP request to execute system commands on the CommandPost and return results in an HTTP response in an authenticated session. The vulnerability is present in Fidelis Network and Deception versions prior to 9.3.7 and in version 9.4. Patches and updates are available to address this vulnerability.

References (2)

Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://www.securifera.com/blog/2021/06/24/operation-eagle-eye/

Scores

CVSS v3 9.9
EPSS 0.0461
EPSS Percentile 90.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Details

CWE
CWE-78 CWE-89
Status published
Products (4)
fidelissecurity/deception 9.4
fidelissecurity/deception < 9.3.7
fidelissecurity/network 9.4
fidelissecurity/network < 9.3.7
Published Jun 25, 2021
Tracked Since Feb 18, 2026