Several Vulnerabilities Exist in SolarWinds Products, Including a Zero-Day

Summary

Several vulnerabilities exist in SolarWinds products. SolarWinds patched one vulnerability in their Serv-U FTP and two vulnerabilities in their Orion product. The Serv-U FTP vulnerability could allow a local user, or one logged in remotely via RDP, to add a privileged account. The first Orion vulnerability could allow a remote, unauthenticated user to execute code to gain control of the operating system, while the second and more severe vulnerability could allow a threat actor to access secured credentials and gain control of the Windows server. Lastly, a zero-day vulnerability exists in the SMA 100 series line of remote access applications that is being exploited in the wild.

Recommendations

The NJCCIC highly recommends organizations running impacted SolarWinds software apply the patches or workarounds as soon as possible. Details on the vulnerabilities can be found in the SolarWinds alert and ZDNet article.