Incidentally, during a critical oversight, SolarWinds developers unintentionally left some hardcoded credentials within the web help desk (WHD), opening the vulnerable instances to easy malicious access without the deployment of any backdoor.

SolarWinds’ Web Help Desk (WHD) is a web-based IT service management solution that streamlines help desk and IT support operations by offering a centralized platform for tracking and resolving service requests. Used by sectors like healthcare, government, and financial services, a vulnerability in WHD that allows remote access could compromise sensitive data in these critical industries.

Second helpdesk criticality exploited

Exploitation of CVE-2024-28987 makes this the second time a critical flaw in SolarWinds WHD was exploited in the wild. Fixed days before CVE-2024-28987, another critical WHD bug (CVE-2024-28986) with a CVSS score of 9.8 out of 10 had reportedly allowed attackers to perform remote code execution (RCE) on vulnerable instances.