PatchTheCVEdeception vulnerabilities and fixes
Recent CVEs affecting deception, with upgrade or downgrade steps. 13 tracked.
deception has 13 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 13. Most recent: 2022-05-17. Highest priority: CVE-2021-35049 (score 63/100).
- CVE-2022-24394 HIGH 8.8 UPGRADE UPGRADE Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the
- CVE-2022-24393 HIGH 8.8 UPGRADE UPGRADE Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the
- CVE-2022-24392 HIGH 8.8 UPGRADE UPGRADE Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the
- CVE-2022-24391 HIGH 8.8 UPGRADE UPGRADE Vulnerability in Fidelis Network and Deception CommandPost enables SQL injection through the web interface by
- CVE-2022-24390 HIGH 8.8 UPGRADE UPGRADE Vulnerability in rconfig “remote_text_file” enables an attacker with user level access to the CLI to inject us
- CVE-2022-24389 HIGH 8.8 UPGRADE UPGRADE Vulnerability in rconfig “cert_utils” enables an attacker with user level access to the CLI to inject root lev
- CVE-2022-24388 HIGH 8.8 UPGRADE UPGRADE Vulnerability in rconfig “date” enables an attacker with user level access to the CLI to inject root level com
- CVE-2022-0997 LOW 3.9 UPGRADE UPGRADE Improper file permissions in the CommandPost, Collector, and Sensor components of Fidelis Network and Deceptio
- CVE-2022-0486 MEDIUM 4.4 UPGRADE UPGRADE Improper file permissions in the CommandPost, Collector, Sensor, and Sandbox components of Fidelis Network and
- CVE-2021-35050 MEDIUM 6.5 UPGRADE UPGRADE User credentials stored in a recoverable format within Fidelis Network and Deception CommandPost
- CVE-2021-35049 CRITICAL 9.9 UPGRADE UPGRADE Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the
- CVE-2021-35048 CRITICAL 9.8 UPGRADE UPGRADE Vulnerability in Fidelis Network and Deception CommandPost enables unauthenticated SQL injection through the w
- CVE-2021-35047 CRITICAL 9.9 UPGRADE UPGRADE Vulnerability in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an
FAQ
How do I fix deception vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is deception being exploited right now?
None of the tracked deception CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which deception CVE should I patch first?
CVE-2021-35049 currently ranks highest (63/100): Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the.