CVE-2022-31199criticalunder attackransomwareCWE-502

CVE-2022-31199

Published · Updated

90Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 9.8epss 36%
from disclosure to weapon1105 days
Published on NVDNov 8
1st PoC+1105d
CISA KEV+245d
exploitation probability
36%top 2% of all CVEs
observed exploitation
yesCISA + VulnCheck
2 public exploit(s)
Action required by CISAfederal deadline: 2023-08-01

Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

In short

A vulnerability in Netwrix Auditor's video recording component allows unauthenticated attackers to remotely execute arbitrary code with system-level privileges on affected servers and monitored systems. This is a critical flaw because attackers can gain complete control without needing valid credentials.

Technical detail

CWE-502 (deserialization of untrusted data) enables unauthenticated remote code execution via the User Activity Video Recording protocol component. An attacker can send malicious messages to the affected component (Netwrix Auditor server or agents) without authentication to achieve arbitrary code execution with NT AUTHORITY\SYSTEM privileges. The vulnerability impacts both the monitoring infrastructure and any systems monitored by Netwrix Auditor.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting both the Netwrix Auditor server and agents installed on monitored systems. The remote code execution vulnerabilities exist within the underlying protocol used by the component, and potentially allow an unauthenticated remote attacker to execute arbitrary code as the NT AUTHORITY\SYSTEM user on affected systems, including on systems Netwrix Auditor monitors.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
public PoCs found — 2
githubgithub.com/developerfred/CVE-2022-31199★ 0vulncheckvulncheck.com/xdb/3a3784416b31unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
https://bishopfox.com/blog/netwrix-auditor-advisoryhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-31199