PT-2020-19899 · Solarwinds · Solarwinds N-Central

Published 2020-01-26 · Updated 2020-02-05 · CVE-2020-7984

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SolarWinds N-central versions 12.1 before SP1 HF5 SolarWinds N-central versions 12.2 before SP1 HF2

Description The issue allows remote attackers to retrieve cleartext domain admin credentials from the Agent & Probe settings and obtain other sensitive information. An attacker can use a customer ID to self-register and read any aspects of the agent/appliance configuration.

Recommendations For SolarWinds N-central version 12.1, update to at least SP1 HF5 to resolve the issue. For SolarWinds N-central version 12.2, update to at least SP1 HF2 to resolve the issue.

Exploit

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2020-7984

Affected Products

Solarwinds N-Central

References · 11

• 🔥 https://blog.huntresslabs.com/validating-the-solarwinds-n-central-dumpster-diver-vulnerability-5e3a045982e5 · Exploit
• https://community.solarwindsmsp.com/Support/Software-Downloads/MSP-N-Central/MSP-N-central-12-1-SP1-HF5 · Vendor Advisory
• https://success.solarwindsmsp.com/kb/solarwinds_n-central/How-to-Expunge-credentials-for-Customer-levels-of-SolarWinds-N-central · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7984 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7984 · Vendor Advisory
• https://community.solarwindsmsp.com/Support/Software-Downloads/MSP-N-Central/MSP-N-central-12-2-SP1-HF2 · Vendor Advisory
• https://crn.com/news/managed-services/solarwinds-rmm-tool-has-open-zero-day-exploit-huntress-labs · Note
• https://github.com/flipflopfpv · Note
• https://twitter.com/SecurityNewsbot/status/1219722631898812416 · Note
• https://t.me/cvenotify/417 · Telegram Post
• https://packetstormsecurity.com/files/156033 · Note