CVE-2023-40054 SolarWinds Network Configuration Manager Directory Traversal Remote Code Execution Vulnerability

2023-11-0915:05:53

CWE-22

SolarWinds

www.cve.org

solarwinds

network configuration manager

directory traversal

remote code execution

vulnerability

low-level user

system privileges

cve-2023-40054

cve-2023-33226

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

9.1

Confidence

High

EPSS

0.008

Percentile

81.7%

JSON

The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows a low-level user to perform the actions with SYSTEM privileges. We found this issue was not resolved in CVE-2023-33226

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Network Configuration Manager",
    "vendor": "SolarWinds ",
    "versions": [
      {
        "status": "affected",
        "version": "2023.4 and previous versions"
      }
    ]
  }
]