VulnerabilityModified

CVE-2022-46414

Unauthenticated remote command execution can occur via the management portal.

CRITICAL 9.8EPSS 1.26%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.26%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

An issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100. Unauthenticated remote command execution can occur via the management portal.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 1.26% probability · 68th percentile
CISA KEV: Not listed
Weakness: CWE-306
Affected: veritas/access appliance · veritas/netbackup flex scale appliance
Source: cve@mitre.org

References

https://www.veritas.com/content/support/en_US/security/VTS22-019#issue1Vendor Advisory
https://www.veritas.com/content/support/en_US/security/VTS22-019#issue1Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.