Netwrix · Auditor

CVE-2022-31199

Netwrix Auditor Insecure Object Deserialization Vulnerability

Exploited in attacks Used by ransomware Critical 9.8 Attack chance: 36%

What it is

Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting both the Netwrix Auditor server and agents installed on monitored systems. The remote code execution vulnerabilities exist within the underlying protocol used by the component, and potentially allow an unauthenticated remote attacker to execute arbitrary code as the NT AUTHORITY\SYSTEM user on affected systems, including on systems Netwrix Auditor monitors.

CISA: Netwrix Auditor User Activity Video Recording component contains an insecure objection deserialization vulnerability that allows an unauthenticated, remote attacker to execute code as the NT AUTHORITY\SYSTEM user. Successful exploitation requires that the attacker is able to reach port 9004/TCP, which is commonly blocked by standard enterprise firewalling.

What to do

Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

Deadline for US federal agencies: August 1, 2023

Added to the CISA list: July 11, 2023
Published: November 8, 2022
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 36% in the top 1.5% of all known vulnerabilities
Weakness: CWE-502 CWE-122
More details: NVD · CVE.org · CISA

All references (1)

https://bishopfox.com/blog/netwrix-auditor-advisory

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.