CVE-2022-24390
HIGHFidelis Network & Deception <9.4.5 - Command Injection
Title source: llmDescription
Vulnerability in rconfig “remote_text_file” enables an attacker with user level access to the CLI to inject user level commands into Fidelis Network and Deception CommandPost, Collector, Sensor, and Sandbox components as well as neighboring Fidelis components. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability.
References (1)
Core 1
Core References
Permissions Required, Vendor Advisory x_refsource_confirm
https://fidelissecurity.zendesk.com/hc/en-us/articles/6211730139411
Scores
CVSS v3
8.8
EPSS
0.0115
EPSS Percentile
62.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-77
CWE-78
Status
published
Products (2)
fidelissecurity/deception
< 9.4.5
fidelissecurity/network
< 9.4.5
Published
May 17, 2022
Tracked Since
Feb 18, 2026