CVE-2022-47529

EPSS 1.6%

Vexday Risk Score

23Low

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Proof of concept

Popular PoC on GitHub (1 stars) — exploitation code widely available.

CVSS —EPSS 1.6%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

24 Mar 2023Public PoC

28 Mar 2023Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

Insecure Win32 memory objects in Endpoint Windows Agents in RSA NetWitness Platform before 12.2 allow local and admin Windows user accounts to modify the endpoint agent service configuration: to either disable it completely or run user-supplied code or commands, thereby bypassing tamper-protection features via ACL modification.

Affected products

n/a · n/a

public PoCs found — 3

githubgithub.com/hyp3rlinx/CVE-2022-47529★ 1 cve_referencepacketstormsecurity.com/files/171476/RSA-NetWitness-Endpoint-EDR-Agent-12.x-Incorrect-Access-Control-Code-Execution.htmlunverified exploitdbwww.exploit-db.com/exploits/51336unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://community.netwitness.com/t5/netwitness-platform-security/nw-2023-04-netwitness-platform-security-advisory-cve-2022-47529/ta-p/696935 http://seclists.org/fulldisclosure/2023/Mar/26 http://seclists.org/fulldisclosure/2024/Apr/17 https://github.com/hyp3rlinx/CVE-2022-47529 https://hyp3rlinx.altervista.org/advisories/RSA_NETWITNESS_EDR_AGENT_INCORRECT_ACCESS_CONTROL_CVE-2022-47529.txt https://packetstormsecurity.com/files/171476/RSA-NetWitness-Endpoint-EDR-Agent-12.x-Incorrect-Access-Control-Code-Execution.html https://seclists.org/fulldisclosure/2023/Mar/16 https://twitter.com/hyp3rlinx/status/1639335477839790105