PT-2024-5811 · Solarwinds · Solarwinds Web Help Desk

Published 2024-08-09 · Updated 2026-03-15 · CVE-2024-28986

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SolarWinds Web Help Desk versions prior to 12.8.3 Hotfix 2

Description SolarWinds Web Help Desk is susceptible to a Java deserialization remote code execution issue. Exploitation of this issue could allow a malicious actor to execute arbitrary commands on the host machine. The vulnerability is actively being exploited. While initial reports suggested the vulnerability was unauthenticated, SolarWinds has been unable to reproduce it without authentication after thorough testing. Approximately 812 internet-exposed instances have been identified, with 527 located in the United States. The vulnerability allows for remote code execution via a flaw in Java deserialization.

Recommendations Upgrade SolarWinds Web Help Desk to version 12.8.3 Hotfix 2 or later. Audit all admin accounts on SolarWinds Web Help Desk. Back up critical data before applying the hotfix. Restrict access to the vulnerable module to minimize the risk of exploitation.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2024-06556

CVE-2024-28986

Affected Products

Solarwinds Web Help Desk

References · 140

• https://solarwinds.com/trust-center/security-advisories/CVE-2024-28986 · Vendor Advisory
• https://support.solarwinds.com/SuccessCenter/s/article/WHD-12-8-3-Hotfix-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06556 · Security Note
• https://solarwinds.com/trust-center/security-advisories/cve-2024-28986 · Security Note
• https://osv.dev/vulnerability/CVE-2024-28986 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28986 · Security Note
• https://twitter.com/cyber_sec_raj/status/1971776856891551832 · Twitter Post
• https://twitter.com/transilienceai/status/1831376932786634973 · Twitter Post
• https://twitter.com/DarkReading/status/1824461124068073792 · Twitter Post
• https://twitter.com/patchnow24x7/status/1824043819647774734 · Twitter Post
• https://twitter.com/Patrowl_io/status/1824416973935038913 · Twitter Post
• https://twitter.com/patchnow24x7/status/1824267966969679985 · Twitter Post
• https://twitter.com/jessicadavis/status/1825567147365437454 · Twitter Post
• https://twitter.com/patchnow24x7/status/1824044681862467607 · Twitter Post
• https://twitter.com/fletch_ai/status/1839138239887847727 · Twitter Post