CVE-2022-31199

CriticalActively exploited (CISA KEV)Known to be used in ransomware campaigns

Description

Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting both the Netwrix Auditor server and agents installed on monitored systems. The remote code execution vulnerabilities exist within the underlying protocol used by the component, and potentially allow an unauthenticated remote attacker to execute arbitrary code as the NT AUTHORITY\SYSTEM user on affected systems, including on systems Netwrix Auditor monitors.

SeverityCritical

CVSS9.8

Exploit probability—

ProductNetwrix Auditor

PublishedNov 8, 2022

First seenNov 8, 2022

Added to KEVJul 11, 2023

Weakness typeCWE-502Deserialization of untrusted data

How to fix

CISA required action

Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

CISA due date: Aug 1, 2023

Update

netwrix auditor10.5 or later

Affected products

Product	Affected versions	Fixed in
netwrix auditor	v < 10.5	10.5

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.