PT-2024-7019 · Solarwinds · Solarwinds Web Help Desk

Guy Lederfein · Published 2024-10-15 · Updated 2025-09-27 · CVE-2024-28988

Positive Technologies · (AI Summary)

CVSS v3.1

10

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

**Name of the Vulnerable Software and Affected Versions**

SolarWinds Web Help Desk versions prior to 12.8.3 Hotfix 2

**Description**

SolarWinds Web Help Desk is susceptible to a Java deserialization Remote Code Execution issue. Successful exploitation of this issue allows an unauthenticated attacker to execute arbitrary commands on the host machine. The vulnerability resides in the AjaxProxy component and involves the deserialization of untrusted data. This flaw is actively exploited.

**Recommendations**

Apply the hotfix released by SolarWinds for Web Help Desk.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2024-08272

CVE-2024-28988

ZDI-25-407

Affected Products

Solarwinds Web Help Desk

References · 36

• https://nvd.nist.gov/vuln/detail/CVE-2024-28988 · Security Note
• https://bdu.fstec.ru/vul/2024-08272 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-25-407 · Security Note
• https://twitter.com/TheZDIBugs/status/1935403983956230411 · Twitter Post
• https://twitter.com/zoomeye_team/status/1847106104607879307 · Twitter Post
• https://twitter.com/TweetThreatNews/status/1970580929673302198 · Twitter Post
• https://support.solarwinds.com/SuccessCenter/s/article/WHD-12-8-3-Hotfix-3 · Note
• https://twitter.com/AWNetworks/status/1848436479623635220 · Twitter Post
• https://twitter.com/pravin_karthik/status/1847153496082338164 · Twitter Post
• https://twitter.com/cyber_sec_raj/status/1971776856891551832 · Twitter Post
• https://t.me/cveNotify/136105 · Telegram Post
• https://twitter.com/CCBalert/status/1970495996229538121 · Twitter Post
• https://twitter.com/fridaysecurity/status/1847098376069788046 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1nq2t24/top_10_trending_cves_25092025 · Reddit Post
• https://twitter.com/transilienceai/status/1859461769548157107 · Twitter Post