{"id":"CVE-2022-47529","aliases":["EUVD-2022-50290","GHSA-9qv7-h3f8-5wpx"],"status":"published","title":"Insecure Win32 memory objects in Endpoint Windows Agents in RSA NetWitness Platform before 12.2...","description":"Insecure Win32 memory objects in Endpoint Windows Agents in RSA NetWitness Platform before 12.2 allow local and admin Windows user accounts to modify the endpoint agent service configuration: to either disable it completely or run user-supplied code or commands, thereby bypassing tamper-protection features via ACL modification.","severity":{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0157,"percentile":0.75544,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"published":"2023-03-28T00:00:00Z","modified":"2026-06-17T05:13:50Z","exploits":[{"source":"exploitdb","id":"EDB-51336","title":"RSA NetWitness Platform 12.2 - Incorrect Access Control / Code Execution","type":"local","platform":"windows","date":"2023-04-08","url":"https://www.exploit-db.com/exploits/51336"},{"source":"pocgithub","id":"hyp3rlinx/CVE-2022-47529","title":"hyp3rlinx/CVE-2022-47529","date":"2023-03-24","url":"https://github.com/hyp3rlinx/CVE-2022-47529"}],"products":[{"vendor":"rsa","product":"netwitness"}],"references":[{"url":"https://twitter.com/hyp3rlinx/status/1639335477839790105","tags":["x_transferred","Third Party Advisory"]},{"url":"https://hyp3rlinx.altervista.org/advisories/RSA_NETWITNESS_EDR_AGENT_INCORRECT_ACCESS_CONTROL_CVE-2022-47529.txt","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"https://packetstormsecurity.com/files/171476/RSA-NetWitness-Endpoint-EDR-Agent-12.x-Incorrect-Access-Control-Code-Execution.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://seclists.org/fulldisclosure/2023/Mar/16","tags":["x_transferred","Mailing List","Third Party Advisory"]},{"url":"https://community.netwitness.com/t5/netwitness-platform-security/nw-2023-04-netwitness-platform-security-advisory-cve-2022-47529/ta-p/696935","tags":["x_transferred","Permissions Required"]},{"url":"http://seclists.org/fulldisclosure/2023/Mar/26","tags":["mailing-list","x_transferred","Exploit","Mailing List","Third Party Advisory"]},{"url":"https://github.com/hyp3rlinx/CVE-2022-47529","tags":["x_transferred"]},{"url":"http://seclists.org/fulldisclosure/2024/Apr/17","tags":["mailing-list","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-47529"},{"url":"https://github.com/advisories/GHSA-9qv7-h3f8-5wpx"}],"sources":{"cve":[{"id":"CVE-2022-47529","description":"Insecure Win32 memory objects in Endpoint Windows Agents in RSA NetWitness Platform before 12.2 allow local and admin Windows user accounts to modify the endpoint agent service configuration: to either disable it completely or run user-supplied code or commands, thereby bypassing tamper-protection features via ACL modification.","status":"published","published":"2023-03-28T00:00:00Z","modified":"2024-08-03T14:55:08.33Z","updated_at":"2026-11-02T14:34:24.971323Z"}],"euvd":[{"id":"EUVD-2022-50290","description":"Insecure Win32 memory objects in Endpoint Windows Agents in RSA NetWitness Platform before 12.2 allow local and admin Windows user accounts to modify the endpoint agent service configuration: to either disable it completely or run user-supplied code or commands, thereby bypassing tamper-protection features via ACL modification.","status":"published","published":"2023-03-28T00:00:00Z","modified":"2024-08-03T14:55:08Z","updated_at":"2026-11-03T03:25:18.56035Z"}],"ghsa":[{"id":"GHSA-9qv7-h3f8-5wpx","title":"Insecure Win32 memory objects in Endpoint Windows Agents in RSA NetWitness Platform before 12.2...","description":"Insecure Win32 memory objects in Endpoint Windows Agents in RSA NetWitness Platform before 12.2 allow local and admin Windows user accounts to modify the endpoint agent service configuration: to either disable it completely or run user-supplied code or commands, thereby bypassing tamper-protection features via ACL modification.","status":"published","published":"2023-03-28T15:30:18Z","modified":"2024-04-11T09:30:55Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T14:57:05.919117Z"}],"nvd":[{"id":"CVE-2022-47529","description":"Insecure Win32 memory objects in Endpoint Windows Agents in RSA NetWitness Platform before 12.2 allow local and admin Windows user accounts to modify the endpoint agent service configuration: to either disable it completely or run user-supplied code or commands, thereby bypassing tamper-protection features via ACL modification.","status":"published","published":"2023-03-28T13:15:07.087Z","modified":"2026-06-17T05:13:50.133Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:07:37.020555Z"}]}}