High severity8.8NVD Advisory· Published May 17, 2022· Updated Jun 17, 2026

CVE-2022-24391

Description

Vulnerability in Fidelis Network and Deception CommandPost enables SQL injection through the web interface by an attacker with user level access. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability.

Affected products

Fidelissecurity/Deception
cpe:2.3:a:fidelissecurity:deception:*:*:*:*:*:*:*:*
Range: <9.4.5
Fidelissecurity/Network
cpe:2.3:a:fidelissecurity:network:*:*:*:*:*:*:*:*
Range: <9.4.5
Fidelis Cybersecurity/Network and Deception CommandPostllm-create
Range: <9.4.5
Fidelis Cybersecurity/Fidelis Deceptionv5
Range: Fidelis Deception

Patches

Vulnerability mechanics

References

fidelissecurity.zendesk.com/hc/en-us/articles/6211730139411nvdPermissions RequiredVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000