Critical SolarWinds flaw finds exploitations in the wild despite available fixes

Home / Security, Vulnerabilities / Critical SolarWinds flaw finds exploitations in the wild despite available fixes

Critical SolarWinds flaw finds exploitations in the wild despite available fixes

October 17, 2024 cyberelias 0 Comments 1 tag

Incidentally, during a critical oversight, SolarWinds developers unintentionally left some hardcoded credentials within the web help desk (WHD), opening the vulnerable instances to easy malicious access without the deployment of any backdoor.

SolarWinds’ Web Help Desk (WHD) is a web-based IT service management solution that streamlines help desk and IT support operations by offering a centralized platform for tracking and resolving service requests. Used by sectors like healthcare, government, and financial services, a vulnerability in WHD that allows remote access could compromise sensitive data in these critical industries.

Second helpdesk criticality exploited

Exploitation of CVE-2024-28987 makes this the second time a critical flaw in SolarWinds WHD was exploited in the wild. Fixed days before CVE-2024-28987, another critical WHD bug (CVE-2024-28986) with a CVSS score of 9.8 out of 10 had reportedly allowed attackers to perform remote code execution (RCE) on vulnerable instances.

Tags: Security, Vulnerabilities

Explore More

CISOs who delayed patching Palo Alto vulnerabilities now face real threat

“Palo Alto Networks has observed threat activity exploiting an unauthenticated remote command execution vulnerability against a limited number of firewall management interfaces which are exposed to the Internet,” Palo Alto

While the payload included the promised functionality, which itself accounts for piracy, it also delivered “sophisticated” malware directly onto users’ computers. Because Foxit’s installation directory resides in the “Program Files”

Apache geht auf die Jagd nach eigenen Fehler und macht fette Beute. monticello – shutterstock.com Eine neue Sicherheitslücke in Apache OFBiz, einem Java-basierten ERP-Framework für Geschäftsprozesse wie Buchhaltung und E-Commerce, ermöglicht