CVE-2022-34906
📋 TL;DR
FileWave versions before 14.6.3 and 14.7.x before 14.7.2 use a hard-coded cryptographic key, allowing unauthenticated attackers to decrypt sensitive information stored in the system and potentially send crafted requests. This affects organizations using vulnerable FileWave Mobile Device Management (MDM) deployments.
💻 Affected Systems
- FileWave Mobile Device Management
📦 What is this software?
Filewave by Filewave
Filewave by Filewave
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of encrypted sensitive data (credentials, configurations, device information) and ability to send malicious commands to managed devices.
Likely Case
Exfiltration of sensitive configuration data and potential unauthorized access to MDM-controlled systems.
If Mitigated
Limited impact if proper network segmentation and access controls prevent external access to FileWave servers.
🎯 Exploit Status
Exploitation requires knowledge of the hard-coded key but no authentication to the system.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 14.6.3 or 14.7.2
Vendor Advisory: https://kb.filewave.com/pages/viewpage.action?pageId=55544244
Restart Required: Yes
Instructions:
1. Backup FileWave configuration and data. 2. Download and install FileWave version 14.6.3 or 14.7.2 from vendor portal. 3. Restart FileWave services. 4. Verify successful update.
🔧 Temporary Workarounds
Network Isolation
allRestrict network access to FileWave servers to trusted internal networks only.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate FileWave servers from untrusted networks
- Monitor for unusual decryption attempts or unauthorized access to FileWave services
🔍 How to Verify
Check if Vulnerable:
Check FileWave version in admin console or via command line: On Linux: /usr/local/filewave/fwcld -v, On Windows: Check installed programs listCheck Version:
On Linux: /usr/local/filewave/fwcld -v, On Windows: Check Control Panel > Programs and FeaturesVerify Fix Applied:
Confirm version is 14.6.3 or higher, or 14.7.2 or higher using same version check commands📡 Detection & Monitoring
Log Indicators:
- Unusual decryption attempts
- Unauthorized access to FileWave API endpoints
- Failed authentication from unexpected sources
Network Indicators:
- Unusual traffic patterns to FileWave servers from external IPs
- Suspicious API calls to FileWave services
SIEM Query:
source="filewave" AND (event_type="decryption" OR event_type="api_access") AND src_ip NOT IN (trusted_networks)🔗 References
- https://claroty.com/2022/07/25/blog-research-with-management-comes-risk-finding-flaws-in-filewave-mdm/
- https://kb.filewave.com/pages/viewpage.action?pageId=55544244
- https://claroty.com/2022/07/25/blog-research-with-management-comes-risk-finding-flaws-in-filewave-mdm/
- https://kb.filewave.com/pages/viewpage.action?pageId=55544244
