Incidentally, during a critical oversight, SolarWinds developers unintentionally left some hardcoded credentials within the web help desk (WHD), opening the vulnerable instances to easy malicious access without the deployment of any backdoor.

SolarWinds’ Web Help Desk (WHD) is a web-based IT service management solution that streamlines help desk and IT support operations by offering a centralized platform for tracking and resolving service requests. Used by sectors like healthcare, government, and financial services, a vulnerability in WHD that allows remote access could compromise sensitive data in these critical industries.

Second helpdesk criticality exploited

Exploitation of CVE-2024-28987 makes this the second time a critical flaw in SolarWinds WHD was exploited in the wild. Fixed days before CVE-2024-28987, another critical WHD bug (CVE-2024-28986) with a CVSS score of 9.8 out of 10 had reportedly allowed attackers to perform remote code execution (RCE) on vulnerable instances.

Tags:

Leave a Reply

Your email address will not be published. Required fields are marked *

Explore More

Spectre flaw still haunts Intel and AMD chips, putting security at risk

Wikner and Razavi’s research found that even with the IBPB defense, Intel’s processors still allow branch predictions to be reused, leading to security leaks. “We found a microcode bug in

Read More

Apache OFBiz behebt neuen kritischen Fehler

Apache geht auf die Jagd nach eigenen Fehler und macht fette Beute. monticello – shutterstock.com Eine neue Sicherheitslücke in Apache OFBiz, einem Java-basierten ERP-Framework für Geschäftsprozesse wie Buchhaltung und E-Commerce, ermöglicht

Read More

QNAP fixes critical security holes in its networking solutions

Critical NAS read and code execution vulnerabilities Tracked as CVE-2024-38643, a missing authentication for critical function vulnerability in QNAP’s note-taking and collaboration application for its NAS devices, Notes Station 3,

Read More