Critical severity flaw warning issued by CISA for SolarWinds Web Help Desk
A bug discovered last summer is being actively exploited
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
A critical vulnerability in a SolarWinds product is being abused in the wild, and now US government agencies have a deadline to patch it or lose it.
The US Cybersecurity and Infrastructure Security Agency (CISA) has addedCVE-2024-28987to its Known Exploited Vulnerabilities (KEV) catalog. When a vulnerability is added to this list, it means there is evidence of in-the-wild abuse.
This flaw resides in Web Help Desk, a web-based IT service management software that streamlines and automates help desk ticketing, asset management, and IT service management processes. It is considered one of SolarWinds’ most popular products, and offers things like ticketing, incident and problem management, and a self-service portal. IT support teams around the world are using this product every day.
Deadline to patch
The bug is the result of a simple oversight by the SolarWinds team - admincredentialswere left hardcoded in Web Help Desk. That means that miscreants can access their targets’ endpoints easily, by logging in as an admin. This flaw carries a severity score of 9.1/10 and is deemed critical. It affects Web Help Desk 12.8.3 HF1 and all previous versions.
The earliest clean version is 12.8.3 HF2.
Since the patch is available, federal agencies have a three-week deadline (by November 5) to apply it. It needs to be applied manually, as there is no automatic solution. Alternatively, they can stop using the tool altogether.
Hardcoded credentials are a frequent occurrence. In October last year, for example, it was found that Cisco Emergency Responder (CER), the company’s emergency communication system used to respond to crises in a timely manner,had hardcoded credentials. In March 2024, researchers found that millions of GitHub projects had the same problem.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
CISA did not detail who the crooks are, who they are targeting with this vulnerability, or how it is being exploited in the real world.
ViaThe Hacker News
More from TechRadar Pro
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
This new phishing strategy utilizes GitHub comments to distribute malware
Should your VPN always be on?
Sonos Arc Ultra review: the best one-box Dolby Atmos soundbar for the price, with one grating flaw
