While no active exploitation has been reported yet, SolarWinds is recommending swift patching to stay ahead of the adversaries. Zach Hanley, the vulnerability researcher credited for the discovery of the vulnerability has promised further details.

“Reported a critical vulnerability to SolarWinds on Friday after digging into the recent CISA KEV CVE-2024-28986 for WebHelpDesk, amazed they’ve already shipped a patch 4 days later!” Hanley wrote on X. “Will release some details next month.”

Additional Fixes

Along with the fix for the WHD hardcoded credential vulnerability, the hotfix, which refers to a small, targeted software update designed to address specific vulnerabilities, also included an upgraded version of a recent hotfix addressing CVE-2024-28986, a 9.8 CVSS, remote code execution vulnerability affecting the same product.

Tags:

Leave a Reply

Your email address will not be published. Required fields are marked *

Explore More

Critical Ivanti flaw exploited despite available patches

CISA has added the vulnerability to its Known Exploited Vulnerability (KEV) Catalogue. EPM raked with RCE flaws The 2022 and prior releases of Ivanti’s EPM, available to customers under the

Read More

A critical Nvidia Container Toolkit bug can allow a complete host takeover

The company added that, under certain circumstances, the successful exploitation of the vulnerability might allow code execution, denial of service, escalation of privileges, information disclosure, and data tampering. Time of

Read More

Google ups bug bounties for ‘high quality’ Chrome hunters

Other levels of compensation, without RCE, include demonstrating a controlled write or a memory corruption. The baseline for bugs that do not demonstrate such “higher-quality reports” range from US$7,000 to

Read More