{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/fidelis-collector--9.4.5/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:fidelissecurity:deception:*:*:*:*:*:*:*:*","cpe:2.3:a:fidelissecurity:network:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":4.4,"id":"CVE-2022-0486"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Fidelis CommandPost (\u003c 9.4.5)","Fidelis Collector (\u003c 9.4.5)","Fidelis Sensor (\u003c 9.4.5)","Fidelis Sandbox (\u003c 9.4.5)","Fidelis Deception (\u003c 9.4.5)"],"_cs_severities":["low"],"_cs_tags":["privilege-escalation","local-access","insecure-permissions"],"_cs_type":"advisory","_cs_vendors":["Fidelissecurity"],"content_html":"\u003cp\u003eCVE-2022-0486 encompasses a series of improper file permission vulnerabilities in Fidelis CommandPost, Collector, Sensor, and Sandbox components of Fidelis Network and Deception. The vulnerabilities exist because the 'fidelis' user holds sudo permissions to execute specific binaries and scripts that the user also owns. This allows a local attacker to modify the files, injecting arbitrary code or spawning shells to achieve root-level privilege escalation.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains local command-line interface (CLI) access as the 'fidelis' user.\u003c/li\u003e\n\u003cli\u003eAttacker identifies a vulnerable binary or script in the /FSS/ directory (e.g., /FSS/bin/shutdown.pl) that is owned by the 'fidelis' user.\u003c/li\u003e\n\u003cli\u003eAttacker modifies the file permissions (e.g., chmod 700 or u+w) to allow write access.\u003c/li\u003e\n\u003cli\u003eAttacker overwrites the content of the target script or binary with malicious code (e.g., executing /bin/sh).\u003c/li\u003e\n\u003cli\u003eAttacker executes the modified file via sudo, providing a password if required by the sudoers configuration.\u003c/li\u003e\n\u003cli\u003eThe command executes with root privileges, granting the attacker full system control.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation grants a local, authenticated 'fidelis' user full root-level control over the affected Fidelis component.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate all Fidelis CommandPost, Collector, Sensor, and Sandbox instances to version 9.4.5 or later immediately.\u003c/li\u003e\n\u003cli\u003eDisable shell/SSH access to Fidelis products after initial configuration to prevent local access vectors.\u003c/li\u003e\n\u003cli\u003eIf patching is not immediately possible, restrict ownership of vulnerable files (e.g., /FSS/bin/shutdown.pl, /FSS/setup/cert_mgmt) to root:fidelis and limit group permissions to read and execute only.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-25T10:42:51Z","date_published":"2026-10-25T10:42:51Z","id":"https://feed.craftedsignal.io/briefs/2026-10-fidelis-lpe/","summary":"Multiple Fidelis products are vulnerable to local privilege escalation due to insecure file permissions on binaries and scripts owned by the fidelis user, allowing for unauthorized root access via sudo.","title":"Fidelis Network and Deception: Local Privilege Escalation (CVE-2022-0486)","url":"https://feed.craftedsignal.io/briefs/2026-10-fidelis-lpe/"}],"language":"en","title":"CraftedSignal Threat Feed - Fidelis Collector (\u003c 9.4.5)","version":"https://jsonfeed.org/version/1.1"}