Multiple Vulnerabilities Discovered in Device42 Asset Management Appliance

guest · Aug 11, 2022

August 11, 2022

A series of vulnerabilities on the popular asset management platform Device42 could be exploited to give attackers full root access to the system, according to Bitdefender.

By exploiting a remote code execution (RCE) vulnerability in the staging instance of the platform, attackers could successfully obtain full root access and gain complete control of the assets housed inside, Bitdefender researchers wrote in the report. The RCE vulnerability (CVE-2022-1399) has a base score of 9.1 out of 10 and is rated "critical," explains Bogdan Botezatu, director of threat research and reporting at Bitdefender.
Chaining Flaws in Attacks
This can be made possible through another vulnerability described in the paper, CVE-2022-1401, that lets anyone on the network read the contents of several sensitive files in the Device42 appliance.
Click to expand...

The file holding session keys are encrypted, but another vulnerability present in the appliance (CVE-2022-1400) helps an attacker retrieve the decryption key that is hardcoded in the app.

"The daisy-chain process would look like this: an unprivileged, unauthenticated attacker on the network would first use CVE-2022-1401 to fetch the encrypted session of an already authenticated user," Botezatu says.
Click to expand...

These vulnerabilities have been addressed. Bitdefender received version 18.01.00 ahead of public release and was able to validate that the four reported vulnerabilities — CVE-2022-1399, CVE-2022-1400, CVE 2022-1401, and CVE-2022-1410 — are no longer present. Organizations should immediately deploy the fixes, he says.
Click to expand...

Bitdefender: A Red Team Perspective on the Device42 Asset Management Appliance
Report (PDF): https://www.bitdefender.com/files/News/CaseStudies/study/422/Bitdefender-PR-Whitepaper-Device42-creat6295-en-EN.pdf

Log in or Sign up

Multiple Vulnerabilities Discovered in Device42 Asset Management Appliance

guest Guest

Log in or Sign up

Multiple Vulnerabilities Discovered in Device42 Asset Management Appliance

guest Guest

Useful Searches