CVE-2021-35050

User credentials stored in a recoverable format within Fidelis Network and Deception CommandPost. In the event that an attacker gains access to the CommandPost, these values could be decoded and used to login to the application. The vulnerability is present in Fidelis Network and Deception versions prior to 9.3.3. This vulnerability has been addressed in version 9.3.3 and subsequent versions.

• CWE-257
• CWE-522

• https://support.fidelissecurity.com/hc/en-us/categories/360001842694-Advisories-News-and-PoliciesPermissions Required, Vendor Advisory
• https://www.securifera.com/blog/2021/06/24/operation-eagle-eye/Exploit, Third Party Advisory
• https://support.fidelissecurity.com/hc/en-us/categories/360001842694-Advisories-News-and-PoliciesPermissions Required, Vendor Advisory
• https://www.securifera.com/blog/2021/06/24/operation-eagle-eye/Exploit, Third Party Advisory

Published

Jun 25, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-35045Cross site scripting (XSS) vulnerability in Ice Hrm 29.0.0.O…6.1
• CVE-2021-35046A session fixation vulnerability was discovered in Ice Hrm 2…6.1
• CVE-2021-35047Vulnerability in the CommandPost, Collector, and Sensor comp…8.8
• CVE-2021-35048Vulnerability in Fidelis Network and Deception CommandPost e…9.8
• CVE-2021-35049Vulnerability in Fidelis Network and Deception CommandPost e…8.8
• CVE-2021-3505A flaw was found in libtpms in versions before 0.8.0. The TP…5.5
• CVE-2021-35052A component in Kaspersky Password Manager could allow an att…7.8
• CVE-2021-35053Possible system denial of service in case of arbitrary chang…7.5
• CVE-2021-35054Minecraft before 1.17.1, when online-mode=false is configure…7.5
• CVE-2021-35055MediaTek microchips, as used in NETGEAR devices through 2021…8.8
• CVE-2021-35056Unisys Stealth 5.1 before 5.1.025.0 and 6.0 before 6.0.055.0…6.7
• CVE-2021-35059OpenWay WAY4 ACS before 1.2.278-2693 allows XSS via the /way…6.1