CVE-2022-24388

HIGH

Fidelis Network & Deception <9.4.5 - Command Injection

Title source: llm
STIX 2.1

Description

Vulnerability in rconfig “date” enables an attacker with user level access to the CLI to inject root level commands into Fidelis Network and Deception CommandPost, Collector, Sensor, and Sandbox components as well as neighboring Fidelis components. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability.

References (1)

Core 1
Core References
Permissions Required, Vendor Advisory x_refsource_confirm
https://fidelissecurity.zendesk.com/hc/en-us/articles/6211730139411

Scores

CVSS v3 8.8
EPSS 0.0134
EPSS Percentile 67.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-77 CWE-78
Status published
Products (2)
fidelissecurity/deception < 9.4.5
fidelissecurity/network < 9.4.5
Published May 17, 2022
Tracked Since Feb 18, 2026