CVE-2024-28075: SolarWinds ARM Deserialization of Untrusted Data Remote Code Execution
First published: Thu May 09 2024(Updated: )
The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an authenticated user to abuse SolarWinds service resulting in remote code execution. We thank Trend Micro Zero Day Initiative (ZDI) for its ongoing partnership in coordinating with SolarWinds on responsible disclosure of this and other potential vulnerabilities.
Credit: psirt@solarwinds.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SolarWinds Access Rights Manager | ||
| <2023.2.4 |
Remedy
All SolarWinds Access Rights Manager customers are advised to upgrade to the latest version of the SolarWinds Access Rights Manager 2023.2.4
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-28075?
CVE-2024-28075 is considered a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2024-28075?
To fix CVE-2024-28075, ensure that you update your SolarWinds Access Rights Manager to the latest patched version.
Who can exploit CVE-2024-28075?
CVE-2024-28075 can be exploited by an authenticated user of SolarWinds Access Rights Manager.
What type of vulnerability is CVE-2024-28075?
CVE-2024-28075 is classified as a Remote Code Execution (RCE) vulnerability.
What impact does CVE-2024-28075 have on my system?
The impact of CVE-2024-28075 may allow unauthorized execution of code, potentially compromising system integrity.
- agent/remedy
- agent/weakness
- agent/references
- agent/title
- agent/type
- agent/description
- agent/first-publish-date
- agent/severity
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- vendor/solarwinds
- canonical/solarwinds access rights manager