CVE-2022-24394

CVE-2022-24394 is a high-severity command injection vulnerability affecting Fidelis Network and Deception CommandPost versions prior to 9.4.5. An authenticated attacker can exploit this flaw through the web interface by manipulating the "filename" parameter in an "update_checkfile" request, leading to arbitrary system command execution and result return via HTTP response. With a CVSS score of 8.8 (HIGH), this vulnerability allows for complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) with low attack complexity and no user interaction required. While patches are available, there is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.