CVE-2020-14005: SolarWinds Network Performance Monitor ExecuteVBScript Command Injection Remote Code Execution Vulnerability
Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows remote attackers to execute arbitrary code via a defined event.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Network Performance Monitor. Authentication is required to exploit this vulnerability. The specific flaw exists within the ExecuteExternalProgram method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of system.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Network Performance Monitor. Authentication is required to exploit this vulnerability. The specific flaw exists within the ExecuteVBScript method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-14005?
CVE-2020-14005 is a vulnerability that allows remote attackers to execute arbitrary code on affected installations of SolarWinds Network Performance Monitor.
What is the severity of CVE-2020-14005?
CVE-2020-14005 has a severity rating of 8.8, which is classified as critical.
How does CVE-2020-14005 exploit the vulnerability?
CVE-2020-14005 exploits the vulnerability by taking advantage of the ExecuteExternalProgram method in SolarWinds Network Performance Monitor.
How can I fix CVE-2020-14005?
To fix CVE-2020-14005, it is recommended to apply the necessary patches or updates provided by SolarWinds.
Where can I find more information about CVE-2020-14005?
You can find more information about CVE-2020-14005 on the following sources: [1] [2] [3]