Critical Insecure Object Deserialization in Netwrix Auditor Enables Remote Code Execution as SYSTEM
What It Is
Netwrix Auditor’s User Activity Video Recording component contains an insecure object‑deserialization flaw. An attacker who can reach the service on TCP 9004 can supply crafted data that triggers arbitrary code execution, running with the highly privileged NT AUTHORITY\SYSTEM account.
Exploitability
The vulnerability is actively exploitable; no authentication is required. A proof‑of‑concept exists in public advisories. Exploitation hinges on network reachability to port 9004, which many enterprises already block, but mis‑configured firewalls or internal lateral movement can expose the service. CVSS v3.1 base score is 9.8 (Critical).
Affected Products
- Vendor: Netwrix
- Product: Netwrix Auditor (User Activity Video Recording component)
Why It Matters for Compliance & Audit Readiness
- Control‑Assurance Impact: The flaw subverts the integrity of audit data by allowing an attacker to execute code with SYSTEM rights, potentially tampering with logs that are core evidence for regulatory audits (PCI DSS, ISO 27001, SOC 2).
- Continuous Control Monitoring: Detecting unexpected traffic to port 9004 and monitoring for anomalous process creation become essential control‑validation activities.
- Vendor‑Management Controls: Demonstrating that third‑party software is patched and that security baselines are enforced satisfies due‑diligence requirements in many frameworks.
- Defensible Audit Trail: By remediating the vulnerability and documenting the remediation steps (patch, firewall rule, monitoring), organizations create a clear, auditable record of risk mitigation.
Recommended Actions
- Patch Immediately: Apply Netwrix’s security update that addresses CVE‑2022‑31199.
- Network Segmentation: Block inbound/outbound traffic to TCP 9004 from untrusted networks; restrict to localhost or management VLANs.
- Validate Post‑Remediation: Run vulnerability scans and verify that the deserialization flaw is no longer present.
- Update Vendor‑Management Evidence: Record the patch status, firewall rule change, and monitoring configuration in your vendor risk register.
- Enhance Monitoring: Enable alerts for new processes launched under SYSTEM and for any traffic on port 9004.
Source: CISA KEV – CVE‑2022‑31199