1,000 Organizations Exposed to Remote Attacks by FileWave MDM Vulnerabilities

guest · Jul 25, 2022

July 25, 2022

Claroty researchers discovered recently that the FileWave MDM product is affected by two critical security holes: an authentication bypass issue (CVE-2022-34907) and a hardcoded cryptographic key (CVE-2022-34906). The vendor quickly patched the flaws.

The authentication bypass vulnerability could allow a remote attacker to achieve “super_user” access and take full control of an internet-connected MDM instance. From there, the attacker could hack all devices managed using the FileWave product, including to steal sensitive information and deliver malware.
Click to expand...

The cybersecurity firm conducted experiments to show how an attacker could exploit CVE-2022-34907 to obtain information about the managed devices and to install ransomware on each system, including macOS, iOS, Windows and Android devices.

“This exploit, if used maliciously, could allow remote attackers to easily attack and infect all internet-accessible instances managed by the FileWave MDM, below, allowing attackers to control all managed devices, gaining access to users’ personal home networks, organizations’ internal networks, and much more,” Claroty said in a blog post published on Monday.
Click to expand...

Claroty: With Management Comes Risk: Finding Flaws in FileWave MDM

Executive Summary

Team82 has uncovered and disclosed two critical vulnerabilities, CVE-2022-34907 and CVE-2022-34906, in FileWave’s mobile device management (MDM) system.

The vulnerabilities are remotely exploitable and enable an attacker to bypass authentication mechanisms and gain full control over the MDM platform and its managed devices.

CVE-2022-34907, an authentication bypass flaw exists in FileWave MDM before version 14.6.3 and 14.7.x, prior to 14.7.2. This vulnerability is similar in nature to the vulnerability that was recently identified in F5 BIG-IP WAF.

CVE-2022-34906, a hard-coded cryptographic key, exists in FileWave MDM prior to version 14.6.3 and 14.7.x, prior to 14.7.2.

Click to expand...

During our research, we found thousands of vulnerable internet-facing FileWave servers in numerous industries, including government agencies, education, and large enterprises.

FileWave has addressed these vulnerabilities in a recent update, and users are urged to apply the update.

Team82 wishes to acknowledge and thank FileWave for its cooperation and coordination throughout this disclosure. These vulnerabilities were addressed in a prompt, complete fashion, users were notified, and the vast majority were verified as up to date.

Click to expand...

Log in or Sign up

1,000 Organizations Exposed to Remote Attacks by FileWave MDM Vulnerabilities

guest Guest

Log in or Sign up

1,000 Organizations Exposed to Remote Attacks by FileWave MDM Vulnerabilities

guest Guest

Useful Searches