CVE-2022-24394

Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “update_checkfile” value for the “filename” parameter. The vulnerability could allow a specially crafted HTTP request to execute system commands on the CommandPost and return results in an HTTP response via an authenticated session. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability.

• CWE-78
• CWE-77

• https://fidelissecurity.zendesk.com/hc/en-us/articles/6211730139411Permissions Required, Vendor Advisory
• https://fidelissecurity.zendesk.com/hc/en-us/articles/6211730139411Permissions Required, Vendor Advisory

Published

May 17, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24389Vulnerability in rconfig “cert_utils” enables an attacker wi…8.8
• CVE-2022-2439The Easy Digital Downloads – Simple eCommerce for Selling Di…7.2
• CVE-2022-24390Vulnerability in rconfig “remote_text_file” enables an attac…8.8
• CVE-2022-24391Vulnerability in Fidelis Network and Deception CommandPost e…8.8
• CVE-2022-24392Vulnerability in Fidelis Network and Deception CommandPost e…8.8
• CVE-2022-24393Vulnerability in Fidelis Network and Deception CommandPost e…8.8
• CVE-2022-24395SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20,…6.1
• CVE-2022-24396The Simple Diagnostics Agent - versions 1.0 up to version 1.…7.8
• CVE-2022-24397SAP NetWeaver Enterprise Portal - versions 7.30, 7.31, 7.40,…6.1
• CVE-2022-24398Under certain conditions SAP Business Objects Business Intel…6.5
• CVE-2022-24399The SAP Focused Run (Real User Monitoring) - versions 200, 3…6.1
• CVE-2022-2440The Theme Editor plugin for WordPress is vulnerable to deser…7.2