PT-2020-13833 · Solarwinds · Solarwinds Orion

Chudypb + 1 · Published 2020-06-24 · Updated 2023-09-21 · CVE-2020-14005

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Solarwinds Orion versions 2019.4.1 through 2019.4 with Web Console WPM and Orion Platform HF4 or NPM HF2

Description The issue allows remote attackers to execute arbitrary code via a defined event. This can be achieved through command injection, specifically via the ExecuteExternalProgram or ExecuteVBScript commands.

Recommendations For Solarwinds Orion versions 2019.4.1 through 2019.4 with Web Console WPM and Orion Platform HF4 or NPM HF2, consider disabling the ExecuteExternalProgram and ExecuteVBScript commands as a temporary workaround until a patch is available. Restrict access to defined events to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2020-14005

ZDI-21-063

ZDI-21-065

Affected Products

Solarwinds Orion

References · 8

• https://zerodayinitiative.com/advisories/ZDI-21-063 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-14005 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-065 · Security Note
• https://osv.dev/vulnerability/CVE-2020-14005 · Vendor Advisory
• https://gist.github.com/alert3/c9dcce5474e55f408c93c086c30cdbb7 · Note
• https://twitter.com/soxrok2212/status/1704960380156412240 · Twitter Post
• https://t.me/cybersecuritytechnologies/2565 · Telegram Post
• https://t.me/cvenotify/4632 · Telegram Post