CVE-2019-3980

HIGH

Description

The Solarwinds Dameware Mini Remote Client agent v12.1.0.89 supports smart card authentication which can allow a user to upload an executable to be executed on the DWRCS.exe host. An unauthenticated, remote attacker can request smart card login and upload and execute an arbitrary executable run under the Local System account.

References

https://www.tenable.com/security/research/tra-2019-43

https://www.tenable.com/security/research/tra-227-43

Details

Source: MITRE

Published: 2019-10-08

Updated: 2019-10-22

Type: CWE-20

Risk Information

CVSS v2.0

Base Score: 10

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Impact Score: 10

Exploitability Score: 10

Severity: HIGH

CVSS v3.0

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Impact Score: 5.9

Exploitability Score: 3.9

Severity: CRITICAL

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:solarwinds:dameware_mini_remote_control:12.1.0.89:*:*:*:*:*:*:*

Tenable Plugins

View all (1 total)

IDNameProductFamilySeverity
130458SolarWinds Dameware Mini Remote Control Unauthenticated RCENessusWindows
critical