Buy A Help Desk, Bundle A Remote Access Solution? (SolarWinds Web Help Desk Pre-Auth RCE Chain(s))

Sicherheitsmeldung mit Schweregrad kritisch (CVSS 9.8). Sie wird laut CISA-KEV aktiv ausgenutzt und sollte priorisiert behandelt werden. Betroffene Kennungen: CVE-2024-28986, CVE-2024-28988, CVE-2025-26399, CVE-2025-40552, CVE-2025-40553. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

It’s been a while, but we’re back - in time for story time.Gather round, strap in, and prepare for another depressing journey of “all we wanted to do was reproduce an N-day, and here we are with 0-days”.Today, friends, we’re looking at SolarWinds Web Help Desk, which has seen its fair share of in-the-wild exploitation and while purporting to be a help desk solution - has had far more attention for its ability to provide RCE opportunities, with a confidence-inspiring amount of “oh it’s basically the same thing again”.Deserialization issues have plagued SolarWinds’ Web Help Desk - and have supposedly been “fixed” multiple times. But our opinion is that the public details surrounding these vulnerabilities have left much more to be desired.While we generally avoid publishing “me too” research (that would be boring), we feel our exploitation path of the vulnerabilities described (where there is any overlap) is materially different to the point that we’ve convinced ourselves it’s interesting enough to make an exception.We have absolutely zero doubt that someone on X will tell us we were wrong in this conclusion. Please email this thought to your favourite PSIRT team to receive roughly the same level of attention.Anyway, here we are - today’s story is a story of legacy technologies, questionable deserializers, and the reality that cyber security was painful way before Claude Code took instructions from your 7 year old nephew.At least your nephew can’t tweet at us. For now.What Is SolarWinds Web Help Desk?SolarWinds Web Help Desk is a typical help desk platform. SolarWinds …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen (CVE-2024-28986, CVE-2024-28988, CVE-2025-26399, CVE-2025-40552, CVE-2025-40553): Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://labs.watchtowr.com/buy-a-help-desk-bundle-a-remote-access-solution-solarwinds-web-help-desk-pre-auth-rce-chain-s/
• Priorität HOCH: laut CISA-KEV aktiv ausgenutzt – bevorzugt patchen.
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.
• Erkennung: Logs und Indikatoren (IoCs) auf Ausnutzung prüfen.