CVE-2021-35047 - CVE House
Back to Database
Status published Critical CVE-2021-35047

Privileged Command Injection Vulnerability in Fidelis Network and Deception

Vulnerability Description

Vulnerability in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attacker with user level access to the CLI to inject root level commands into the component and neighboring Fidelis components. The vulnerability is present in Fidelis Network and Deception versions prior to 9.3.7 and in version 9.4. Patches and updates are available to address this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-35047

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Ryan Wincey(@rwincey) & Brandon Peterson(@Barbarisch926), Securifera

References

More from Fidelis Cybersecurity

View All →
CVE-2022-24394
Authenticated Command Injection Vulnerability in Fidelis Network and Deception
High 8.8
CVE-2022-24393
Authenticated Command Injection Vulnerability in Fidelis Network and Deception
High 8.8
CVE-2022-24392
Authenticated Command Injection Vulnerability in Fidelis Network and Deception
High 8.8
CVE-2022-24391
Authenticated SQL Injection Vulnerability in Fidelis Network and Deception
High 8.8
CVE-2022-24390
Authenticated Command Injection Vulnerability in Fidelis Network and Deception
High 8.8

Affected Vendor

Fidelis Cybersecurity

View all reports →

Affected Software

Fidelis Network, Fidelis Deception
Vulnerable Versions:
Fidelis Network 9.4, Fidelis Network, Fidelis Deception 9.4, Fidelis Deception

Timeline

Official Publish: June 25th, 2021
Last Modified: September 16th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-78

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1005 Data from Local System
Collection
T1041 Exfiltration Over C2 Channel
Exfiltration