What is CVE-2022-31199?

CVE-2022-31199 is a critical vulnerability affecting the Netwrix Auditor User Activity Video Recording component, which is present in both the Netwrix Auditor server and agents installed on monitored systems. This vulnerability allows an unauthenticated remote attacker to execute arbitrary code on affected systems, posing a significant risk to the security of these systems. The vulnerability has a severity score of 9.8, indicating its high impact on the affected systems. It is essential for organizations to be aware of this vulnerability and take appropriate measures to protect their systems.

Who is impacted by this?

All supported versions prior to 10.5 are impacted by this vulnerability. In simple terms, this security issue could allow an attacker to gain unauthorized access and control over affected systems, posing a significant risk to the security of these systems.

What should I do if I’m affected?

If you're affected by the CVE-2022-31199 vulnerability, it's crucial to take immediate action to protect your systems. Here's a simplified list of steps to follow:

1. Update to version 10.5 of the Netwrix Auditor application.

2. Regularly update the application to the latest version.

3. Monitor for suspicious activity and investigate potential security incidents.

4. Consider isolating affected assets from the network if necessary.

5. Follow vendor instructions for applying mitigations or discontinue the use of the product if mitigations are unavailable.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2022-31199 vulnerability, also known as the Netwrix Auditor Insecure Object Deserialization Vulnerability, is indeed listed in CISA's Known Exploited Vulnerabilities Catalog. It was added on July 11, 2023, and the due date for addressing the vulnerability is August 1, 2023.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-502, which involves deserialization of untrusted data, potentially allowing remote code execution.

Learn More

For a comprehensive understanding of the vulnerability, its severity, and potential mitigations, consult the NVD page and the resources listed below.

• Bishop Fox: Netwrix Auditor Application Critical Vulnerability

• CISA: BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities

• CISA: Known Exploited Vulnerabilities Catalog