CVE-2022-47529

Insecure Win32 memory objects in Endpoint Windows Agents in RSA NetWitness Platform before 12.2 allow local and admin Windows user accounts to modify the endpoint agent service configuration: to either disable it completely or run user-supplied code or commands, thereby bypassing tamper-protection features via ACL modification.

• http://seclists.org/fulldisclosure/2023/Mar/26Exploit, Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2024/Apr/17
• https://community.netwitness.com/t5/netwitness-platform-security/nw-2023-04-netwitness-platform-security-advisory-cve-2022-47529/ta-p/696935Permissions Required
• https://github.com/hyp3rlinx/CVE-2022-47529
• https://hyp3rlinx.altervista.org/advisories/RSA_NETWITNESS_EDR_AGENT_INCORRECT_ACCESS_CONTROL_CVE-2022-47529.txtExploit, Third Party Advisory
• https://packetstormsecurity.com/files/171476/RSA-NetWitness-Endpoint-EDR-Agent-12.x-Incorrect-Access-Control-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://seclists.org/fulldisclosure/2023/Mar/16Mailing List, Third Party Advisory
• https://twitter.com/hyp3rlinx/status/1639335477839790105Third Party Advisory
• http://seclists.org/fulldisclosure/2023/Mar/26Exploit, Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2024/Apr/17
• https://community.netwitness.com/t5/netwitness-platform-security/nw-2023-04-netwitness-platform-security-advisory-cve-2022-47529/ta-p/696935Permissions Required
• https://github.com/hyp3rlinx/CVE-2022-47529
• https://hyp3rlinx.altervista.org/advisories/RSA_NETWITNESS_EDR_AGENT_INCORRECT_ACCESS_CONTROL_CVE-2022-47529.txtExploit, Third Party Advisory
• https://packetstormsecurity.com/files/171476/RSA-NetWitness-Endpoint-EDR-Agent-12.x-Incorrect-Access-Control-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://seclists.org/fulldisclosure/2023/Mar/16Mailing List, Third Party Advisory
• https://twitter.com/hyp3rlinx/status/1639335477839790105Third Party Advisory

Published

Mar 28, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-47521An issue was discovered in the Linux kernel before 6.0.11. M…7.8
• CVE-2022-47522The IEEE 802.11 specifications through 802.11ax allow physic…7.5
• CVE-2022-47523Zoho ManageEngine Access Manager Plus before 4309, Password …9.8
• CVE-2022-47524F-Secure SAFE Browser 19.1 before 19.2 for Android allows an…5.4
• CVE-2022-47525Fox-IT DataDiode (aka Fox DataDiode) 3.4.3 suffers from a Di…7.5
• CVE-2022-47526Fox-IT DataDiode (aka Fox DataDiode) 3.4.3 suffers from a pa…9.8
• CVE-2022-4753The Print-O-Matic WordPress plugin before 2.1.8 does not val…5.4
• CVE-2022-47531An issue was discovered in Ericsson Evolved Packet Gateway (…8.8
• CVE-2022-47532FileRun 20220519 allows SQL Injection via the "dir" paramete…9.8
• CVE-2022-4754The Easy Social Box / Page Plugin WordPress plugin through 4…5.4
• CVE-2022-47542Red Gate SQL Monitor 11.0.14 through 12.1.46 has Incorrect A…8.8
• CVE-2022-47543An issue was discovered in Siren Investigate before 12.1.7. …5.3