Critical · published June 25, 2021
🚨 A simple command from a user-level account can escalate to total control! An attacker could inject root-level commands into Fidelis components, making this a critical vulnerability! 🔥 Think of this as a guest at a party who finds a way to sneak into the kitchen and start rearranging everything — the result could be chaos in the whole house! An attacker could execute arbitrary commands with root privileges, potentially leading to complete system compromise. This means they could manipulate sensitive data, disrupt services, or even take down essential components in your network.
Think of this as a guest at a party who finds a way to sneak into the kitchen and start rearranging everything — the result could be chaos in the whole house! CVE-2021-35047 exists in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception, allowing user-level CLI access to inject root commands into its components and neighboring systems.
An attacker could execute arbitrary commands with root privileges, potentially leading to complete system compromise. This means they could manipulate sensitive data, disrupt services, or even take down essential components in your network. Upgrade your Fidelis Network and Deception installations to version 9.3.7 or later immediately. Ensure you're applying all available patches to lock down these components and prevent exploitation. Regular audits can help identify any potential ongoing security issues. You've got this! Take action now to secure your systems and keep those digital villains at bay! 🛡️