Following a patch for a zero-day vulnerability in SolarWinds’ Serv-U Managed File Transfer, researchers share new details about the attacks, as over 8,000 systems remain publicly accessible and potentially vulnerable.

CVE-2021-35211: SolarWinds Serv-U Managed File Transfer Zero-Day Vulnerability Exploited in Targeted Attacks

Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 are affected by this vulnerability.

According to its banner, the installed version of Serv-U is a version prior to 15.2.3 Hotfix 2. It is, therefore, affected memory escape vulnerability. An unauthenticated remote attacker who successfully exploited this vulnerability could run arbitrary code with privileges, which could then install programs; view, change, or delete data; or run programs on the affected system.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

CVE-2021-35211

critical

Tenable Plugins

critical