by Kastro
Paper/Archive/CVE-2021-35047

CVE-2021-35047

Fidelis Cybersecurity Fidelis Network — Privileged Command Injection Vulnerability in Fidelis Network and Deception

EPSS 2%CVSS 9.9
critical.is priorityof 100
45
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 76.3.763 × 2015.3No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Vulnerability in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attacker with user level access to the CLI to inject root level commands into the component and neighboring Fidelis components. The vulnerability is present in Fidelis Network and Deception versions prior to 9.3.7 and in version 9.4. Patches and updates are available to address this vulnerability.

Affected

ProductAffectedFixed inSource
Fidelis NetworkFidelis Network 9.4–CNA
Fidelis NetworkFidelis Network – < 9.3.79.3.7CNA
Fidelis DeceptionFidelis Deception 9.4–CNA
Fidelis DeceptionFidelis Deception – < 9.3.79.3.7CNA

Scores by source

Fidelis (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

refsupport.fidelissecurity.com/hc/en-us/categories/360001842694-Advisories-News-and-Policiesrefsecurifera.com/blog/2021/06/24/operation-eagle-eye