Detections
Analytics
SolarWinds DameWare Mini Remote Control < 2026.3.1 Multiple Vulnerabilities
critical Nessus Plugin ID 377037
Synopsis
The remote host is running a remote management application that is affected by multiple vulnerabilities.Description
The version of SolarWinds DameWare Mini Remote Control installed on the remote host is prior to 2026.3.1. It is, therefore, affected by multiple vulnerabilities as referenced in the Dameware 2026.3.1 release notes.- A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. (CVE-2026-111497)
- SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of the remotely controlled host. Authentication is required. (CVE-2026-28336)
- SolarWinds Dameware was found to be affected by a buffer overflow vulnerability that can result in remote code execution. Authentication is required. (CVE-2026-28335)
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Upgrade to SolarWinds Dameware version 2026.3.1 or later.See Also
http://www.nessus.org/u?2580faa5
http://www.nessus.org/u?39d3fdb6
Plugin Details
Severity: Critical
ID: 377037
File Name: solarwinds_dameware_2026_3_1.nasl
Version: 1.1
Type: Local
Agent: windows
Family: Windows
Published: 11/6/2026
Updated: 11/6/2026
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Critical
Score: 9.5
Percentile: 99.88
CVSS v2
Risk Factor: Critical
Base Score: 10
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2026-111497
CVSS v3
Risk Factor: Critical
Base Score: 9.9
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS Score Source: CVE-2026-28336
CVSS v4
Risk Factor: Critical
Base Score: 9.2
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Vulnerability Information
CPE: cpe:/a:solarwinds:dameware_mini_remote_control
Required KB Items: installed_sw/SolarWinds DameWare Mini Remote Control
Patch Publication Date: 11/3/2026
Vulnerability Publication Date: 4/10/2026
CISA Known Exploited Vulnerability Due Dates: 11/10/2026
Reference Information
CVE: CVE-2026-111497, CVE-2026-28327, CVE-2026-28335, CVE-2026-28336, CVE-2026-40021