Critical severity · published Dec 4, 2022
CVE-2022-46414
An issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100
9.8
CVSS
2.5%
EPSS
No
On KEV
Description
An issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100. Unauthenticated remote command execution can occur via the management portal.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
Access Appliance · Veritas
through 8.0.100 · source: NVD
NF
Netbackup Flex Scale Appliance · Veritas
through 3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-46414
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-46414
Vendor Advisory
https://www.veritas.com/content/support/en_US/security/VTS22-019#issue1
More from Access Appliance
9.8
CVE-2022-22965
Spring Framework JDK 9+ Remote Code Execution Vulnerability
9.8
CVE-2019-18780
An arbitrary command injection vulnerability in the Cluster Server component of Veritas InfoScale allows an unauthenticated remote attacker to execute arbitrary commands as root…
8.8
CVE-2022-46413
An issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100
8.8
CVE-2022-46411
An issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100