Vulnerability · Published Mar 28, 2023 · Assigned by mitre
CVE-2022-47529
Medium 6.7
In plain English
A medium-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 75% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS NVD)6.7Medium
Exploit odds (30 days)1.6%top 24.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
Insecure Win32 memory objects in Endpoint Windows Agents in RSA NetWitness Platform before 12.2 allow local and admin Windows user accounts to modify the endpoint agent service configuration: to either disable it completely or run user-supplied code or commands, thereby bypassing tamper-protection features via ACL modification.
Affected products (as reported)
References
- https://twitter.com/hyp3rlinx/status/1639335477839790105
- https://hyp3rlinx.altervista.org/advisories/RSA_NETWITNESS_EDR_AGENT_INCORRECT_ACCESS_CONTROL_CVE-2022-47529.txt
- https://packetstormsecurity.com/files/171476/RSA-NetWitness-Endpoint-EDR-Agent-12.x-Incorrect-Access-Control-Code-Execution.html
- https://seclists.org/fulldisclosure/2023/Mar/16
- https://community.netwitness.com/t5/netwitness-platform-security/nw-2023-04-netwitness-platform-security-advisory-cve-2022-47529/ta-p/696935
- 20230330 RSA NetWitness EDR Agent / Incorrect Access Control - Code Execution / CVE-2022-47529 mailing-list
- https://github.com/hyp3rlinx/CVE-2022-47529
- 20240410 Trojan.Win32.Razy.abc / Insecure Permissions (In memory IPC) mailing-list