{"id":"CVE-2022-31199","kind":"vulnerability","aliases":["CVE-2022-31199"],"related":[],"title":"Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting…","description":"Netwrix Auditor User Activity Video Recording component contains an insecure objection deserialization vulnerability that allows an unauthenticated, remote attacker to execute code as the NT AUTHORITY\\SYSTEM user. Successful exploitation requires that the attacker is able to reach port 9004/TCP, which is commonly blocked by standard enterprise firewalling.\n\nCISA required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","summary":"Netwrix Auditor's User Activity Video Recording component deserializes untrusted objects insecurely, letting an unauthenticated remote attacker reach port 9004/TCP. A successful attack runs code as NT AUTHORITY\\SYSTEM on the Windows host.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2023-07-11T00:00:00+00:00","products":[{"name":"netwrix auditor","fixed":["10.5"],"affected":"< 10.5","ecosystem":"vendor"},{"name":"Netwrix Auditor","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","netwrix-auditor","ransomware","vendor","windows"],"not_affected_if":["no-video-recording-component","port-9004-blocked"],"how_to_check":"Confirm whether the User Activity Video Recording component is installed and whether TCP port 9004 is reachable from untrusted networks.","fix":"Apply the vendor update per Netwrix instructions, or stop using the product if no update is available (CISA required action).\nBlock inbound TCP 9004 at the firewall until patched.","status":"open","published_at":"2022-11-08T01:15:09+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:06:23+00:00","updated_at":"2026-10-24T00:09:51+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-23T21:06:23Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor update per Netwrix instructions, or stop using the product if no update is available (CISA required action).\nBlock inbound TCP 9004 at the firewall until patched.","reach":"network","impact":"high","summary":"Netwrix Auditor's User Activity Video Recording component deserializes untrusted objects insecurely, letting an unauthenticated remote attacker reach port 9004/TCP. A successful attack runs code as NT AUTHORITY\\SYSTEM on the Windows host.","category":"vendor","who_cares":["netwrix-auditor","windows"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attacker runs code as SYSTEM on the Windows server.","analyst_note":"Fixed version and exact check commands are not in the sources; find the patched build and component detection steps at the Netwrix advisory for CVE-2022-31199.","how_to_check":"Confirm whether the User Activity Video Recording component is installed and whether TCP port 9004 is reachable from untrusted networks.\nunknown\nunknown","needs_analyst":true,"not_affected_if":["port-9004-blocked","no-video-recording-component"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000514,"input_tokens":2890,"output_tokens":449,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2022':17A,20A '-31199':18A,21A '9004/tcp':52B,105C 'abl':101C 'action':116C 'activ':11A,37B,69C 'affect':15A 'allow':80C 'appli':117C 'attack':49B,55B,84C,99C 'auditor':9A,23A,25A,29B,34B,67C 'author':60B,91C 'block':109C 'cisa':114C 'code':2A,57B,87C 'common':108C 'compon':14A,40B,72C 'contain':73C 'cve':16A,19A 'deseri':41B,77C 'discontinu':123C 'enterpris':112C 'execut':3A,86C 'exist':5A 'exploit':26B,95C 'firewal':113C 'host':65B 'insecur':44B,75C 'instruct':121C 'let':45B 'netwrix':8A,22A,24A,28B,33B,66C 'netwrix-auditor':27B 'nt':59B,90C 'object':43B,76C 'per':119C 'port':51B,104C 'product':127C 'ransomwar':30B 'reach':50B,103C 'record':13A,39B,71C 'remot':1A,48B,83C 'requir':96C,115C 'run':56B 'standard':111C 'success':54B,94C 'system':61B,92C 'unauthent':47B,82C 'unavail':131C 'untrust':42B 'updat':118C,129C 'use':124C 'user':10A,36B,68C,93C 'vendor':31B,120C 'video':12A,38B,70C 'vulner':4A,78C 'window':32B,64B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-11-08T01:15:09+00:00","kev":{"dateAdded":"2023-07-11","dueDate":"2023-08-01","requiredAction":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-31199","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-31199","severity":null,"published_at":"2023-07-11T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T15:39:41+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-31199","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31199","severity":null,"published_at":"2022-11-08T01:15:09+00:00","modified_at":"2026-06-17T04:45:01+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}