PT-2022-16668

Name of the Vulnerable Software and Affected Versions Fidelis Network and Deception versions prior to 9.4.5 Description The issue allows authenticated command injection through the web interface using the check vertica upgrade value for the cpIp parameter. This could enable a specially crafted HT...

CVE-2022-24394: Improper Neutralization of Special Elements used in an OS Command

Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “updatecheckfile” value for the “filename” parameter. The vulnerability could allow a specially crafted HTTP request to execute system commands on the CommandPost...

Fidelis Network Deception: Command Injection Vulnerability

Fidelis Network Deception is a security product from Fidelis USA. A security vulnerability exists in versions prior to Fidelis Network Deception 9.4.5, which stems from a faulty remotetextfile in rconfig, to detect threats and prevent data loss, detect malicious behavior, identify traffic...

Fidelis Network Deception: Command Injection Vulnerability

Fidelis Network Deception is a security product from Fidelis USA. A security vulnerability exists in versions prior to Fidelis Network Deception 9.4.5, which stems from a problem with date in rconfig. An attacker with CLI user-level access could exploit the vulnerability to inject root-level...

PT-2022-16669

Name of the Vulnerable Software and Affected Versions Fidelis Network and Deception versions prior to 9.4.5 Description The issue allows authenticated command injection through the web interface using the filename parameter with the value "update checkfile". This could enable a specially crafted...

PT-2022-13209

Name of the Vulnerable Software and Affected Versions Fidelis Network and Deception versions prior to 9.4.5 Description The issue is related to improper file permissions in the CommandPost, Collector, Sensor, and Sandbox components, allowing an attacker with local, administrative access to the CL...

Fidelis Network Deception: Command Injection Vulnerability

Fidelis Network Deception is a security product from Fidelis USA. It is used to detect threats and prevent data loss with features such as detecting malicious behavior, identifying traffic anomalies, and automatically responding to advanced threats. A command injection vulnerability exists in...

CVE-2022-0486: Incorrect Default Permissions

Improper file permissions in the CommandPost, Collector, Sensor, and Sandbox components of Fidelis Network and Deception enables an attacker with local, administrative access to the CLI to modify affected files and enable escalation of privileges equivalent to the root user. The vulnerability is...

CVE-2022-24393: Improper Neutralization of Special Elements used in an OS Command

Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “checkverticaupgrade” value for the “cpIp” parameter. The vulnerability could allow a specially crafted HTTP request to execute system commands on the CommandPost...

CVE-2022-24390: Improper Neutralization of Special Elements used in an OS Command

Vulnerability in rconfig “remotetextfile” enables an attacker with user level access to the CLI to inject user level commands into Fidelis Network and Deception CommandPost, Collector, Sensor, and Sandbox components as well as neighboring Fidelis components. The vulnerability is present in Fideli...

CVE-2022-24391: Improper Neutralization of Special Elements used in an SQL Command

Vulnerability in Fidelis Network and Deception CommandPost enables SQL injection through the web interface by an attacker with user level access. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability...

CVE-2022-0997: Incorrect Default Permissions

Improper file permissions in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attacker with local, administrative access to the CLI to modify affected script files, which could result in arbitrary commands being run as root upon subsequent logon by a...

CVE-2022-24389: Improper Neutralization of Special Elements used in an OS Command

Vulnerability in rconfig “certutils” enables an attacker with user level access to the CLI to inject root level commands into Fidelis Network and Deception CommandPost, Collector, Sensor, and Sandbox components as well as neighboring Fidelis components. The vulnerability is present in Fidelis...

CVE-2022-24392: Improper Neutralization of Special Elements used in an OS Command

Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “feedcommtest” value for the “feed” parameter. The vulnerability could allow a specially crafted HTTP request to execute system commands on the CommandPost and...

Fidelis Network and Deception: Command Injection Vulnerabilities

Fidelis Network Deception is a security product from Fidelis USA. It is used to detect threats and prevent data loss with features such as detecting malicious behavior, identifying traffic anomalies, and automatically responding to advanced threats. A security vulnerability exists in Fidelis...

Fidelis Network Deception: Command Injection Vulnerability

Fidelis Network Deception is a security product from Fidelis USA, Inc. A command injection vulnerability exists in versions prior to Fidelis Network Deception 9.4.5, which stems from the filename parameter of CommandPost when using the updatecheckfile value. Command injection exists, and an...

Fidelis Network Deception: Command Injection Vulnerability

Fidelis Network Deception is a security product from Fidelis USA, Inc. A security vulnerability exists in versions prior to Fidelis Network Deception 9.4.5, which stems from the CommandPost cplp parameter when using the checkverticaupgrade value. Command injection exists, and an attacker can use...

CVE-2022-0486

Improper file permissions in the CommandPost, Collector, Sensor, and Sandbox components of Fidelis Network and Deception enables an attacker with local, administrative access to the CLI to modify affected files and enable escalation of privileges equivalent to the root user. The vulnerability is...

CVE-2022-24389

Vulnerability in rconfig “certutils” enables an attacker with user level access to the CLI to inject root level commands into Fidelis Network and Deception CommandPost, Collector, Sensor, and Sandbox components as well as neighboring Fidelis components. The vulnerability is present in Fidelis...

CVE-2022-24392

Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “feedcommtest” value for the “feed” parameter. The vulnerability could allow a specially crafted HTTP request to execute system commands on the CommandPost and...