Summary
Netwrix Auditor User Activity Video Recording component contains an insecure objection deserialization vulnerability that allows an unauthenticated, remote attacker to execute code as the NT AUTHORITY\SYSTEM user. Successful exploitation requires that the attacker is able to reach port 9004/TCP, which is commonly blocked by standard enterprise firewalling.
- Vendor
- Netwrix
- Product
- Auditor
- Added to KEV
- Jul 11, 2023
- Remediation due
- Aug 1, 2023 (US federal deadline)
- Ransomware use
- Known
- Weakness
- CWE-502, CWE-122
- EPSS
- 36.0% as of Nov 12
In the news
- No Asia-Pacific article names this CVE yet.
Linked
Actors named alongside it:
none
Incidents exploiting it:
- none recorded
References