High
CVE-2022-31199
CVE-2022-31199
Description
Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting both the Netwrix Auditor server and agents installed on monitored systems. The remote code execution vulnerabilities exist within the underlying protocol used by the component, and potentially allow an unauthenticated remote attacker to execute arbitrary code as the NT AUTHORITY\SYSTEM user on affected systems, including on systems Netwrix Auditor monitors.
Add Assessment
Technical Analysis
Sounds like Cisco was seeing small-ish-scale exploitation of this bug over the summer to gain initial access and deploy TrueBot payloads. I’d never heard of this product before now, but looking at its website, it looks to be security/IT management software with lots of enterprise customers—i.e., one of those things that’s probably under-scrutinized by researchers (and thus a nifty fun-time target for attackers). Not a lot of internet-facing attack surface area, which is good, but I have to wonder how many people even know there’s a serious vuln in this stuff, let alone how many have actually patched.
CVSS V3 Severity and Metrics
General Information
Vendors
- netwrix
Products
- auditor
References
Miscellaneous
