ZDI-CAN-11858: SolarWinds Network Performance Monitor ExecuteExternalProgram Command Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Network Performance Monitor. Authentication is required to exploit this vulnerability. The specific flaw exists within the ExecuteExternalProgram method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of system.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-11858?
ZDI-CAN-11858 has been categorized with high severity due to its potential for remote code execution.
How do I fix ZDI-CAN-11858?
To fix ZDI-CAN-11858, you should apply the latest security patches provided by SolarWinds for Network Performance Monitor.
What are the consequences of exploiting ZDI-CAN-11858?
Exploitation of ZDI-CAN-11858 can lead to remote attackers executing arbitrary code on the affected systems.
Is authentication required to exploit ZDI-CAN-11858?
Yes, authentication is required to exploit ZDI-CAN-11858 in SolarWinds Network Performance Monitor.
Which version of SolarWinds is affected by ZDI-CAN-11858?
ZDI-CAN-11858 affects specific installations of SolarWinds Network Performance Monitor that have not been updated with the latest security patches.