Paper/Archive/CVE-2022-31199

CVE-2022-31199

Netwrix Auditor — Netwrix Auditor Insecure Object Deserialization Vulnerability

KEV · due 1 Aug ransomware use EPSS 36%public exploit SSVC act CVSS 9.8

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 In CISA KEV+3030.0 EPSS percentile 98.5.985 × 2019.7 Exploit: SSVC active+1010.0 SSVC exploitation: active+1010.0

Description · from the CVE record

Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting both the Netwrix Auditor server and agents installed on monitored systems. The remote code execution vulnerabilities exist within the underlying protocol used by the component, and potentially allow an unauthenticated remote attacker to execute arbitrary code as the NT AUTHORITY\SYSTEM user on affected systems, including on systems Netwrix Auditor monitors.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: active · Automatable: no · Technical impact: total

References

refbishopfox.com/blog/netwrix-auditor-advisory refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-31199 kevcisa.gov/known-exploited-vulnerabilities-catalog