NAV and Business Central Vulnerability Fix CVE 2022 41127

Microsoft Announce a Security Vulnerability

Microsoft have announced a security vulnerability ; “Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability”

Part of the security community have discovered the vulnerability, which is detailed by Microsoft here.

Versions Effected

The following versions are effected by this vulnerability.

Release Date	Product	Platform	Impact	Max Severity	Article	Download	Details
Dec 13, 2022	Microsoft Dynamics 365 Business Central 2021 Release Wave 1		Remote Code Execution	Critical	5019239	Security Update	CVE-2022-41127
Dec 13, 2022	Microsoft Dynamics 365 Business Central 2022 Release Wave 2		Remote Code Execution	Critical	5021672	Security Update	CVE-2022-41127
Dec 13, 2022	Microsoft Dynamics 365 Business Central 2021 Release Wave 2		Remote Code Execution	Critical	5021670	Security Update	CVE-2022-41127
Dec 13, 2022	Microsoft Dynamics 365 Business Central 2022 Release Wave 1		Remote Code Execution	Critical	5021671	Security Update	CVE-2022-41127
Dec 13, 2022	Microsoft Dynamics 365 Business Central 2020 Release Wave 1		Remote Code Execution	Critical	5010910	Security Update	CVE-2022-41127
Dec 13, 2022	Microsoft Dynamics 365 Business Central 2020 Release Wave 2		Remote Code Execution	Critical	5013420	Security Update	CVE-2022-41127
Dec 13, 2022	Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise)		Remote Code Execution	Critical	4528706	Security Update	CVE-2022-41127
Dec 13, 2022	Dynamics 365 Business Central Spring 2019 Update		Remote Code Execution	Critical	5021669	Security Update	CVE-2022-41127
Dec 13, 2022	Microsoft Dynamics NAV 2018		Remote Code Execution	Critical	5021668	Security Update	CVE-2022-41127
Dec 13, 2022	Microsoft Dynamics NAV 2017		Remote Code Execution	Critical	5010202	Security Update	CVE-2022-41127
Dec 13, 2022	Microsoft Dynamics NAV 2016		Remote Code Execution	Critical	5005293	Security Update	CVE-2022-41127

 

What does this mean for you?

The details provided by Microsoft suggest that this is not something that is likely to happen, due to the complexity of attacking the vulnerability and that it requires credentials for a user. However, if the issue is successfully exploited the level of access, damage and data that can be stolen means that breach would be severe.

The problem is resolved by means of a cumulative update, which is available irrespective of whether your version is in mainstream support. The amount of work involved will depend on your own specific solution, such as the number of instances (Test, UAT, Dev, etc). This can either be done internally by yourselves, if you have the skillset in your own resource, or by Dynamics Consultants as a chargeable exercise. If you would like us to help with applying the Cumulative Update, please contact our team.