A deep-dive into the SolarWinds Serv-U SSH vulnerability

🗓️ 02 Sep 2021 16:00:56Reported by Eric AvenaType

A 0-day remote code execution exploit was used to attack SolarWinds Serv-U FTP software. Microsoft identified the attackers as group DEV-0322 from China. The vulnerability tracked as CVE-2021-35211. Attackers exploited the way Serv-U created an OpenSSL AES128-CTR context

Reporter	Title	Published	Views	Family All 36
GithubExploit	Exploit for Out-of-bounds Write in Solarwinds Serv-U	14 Jan 202205:52	–	githubexploit
GithubExploit	Exploit for Out-of-bounds Write in Solarwinds Serv-U	30 Sep 202101:45	–	githubexploit
ATTACKERKB	CVE-2021-35211	13 Jul 202100:00	–	attackerkb
Information Security Automation	Last Week’s Security news: Exploits for ForgeRock, vSphere, Apache Tomcat, new Print Spooler vuln, Kaseya Patch and REvil, SolarWinds, Schneider Electric, Bulletins	19 Jul 202116:29	–	avleonov
BDU FSTEC	The vulnerability of the SSH protocol implementation in the SolarWinds Serv-U File Server file server for Windows operating systems allows a perpetrator to execute arbitrary code or escalate their privileges.	10 Aug 202100:00	–	bdu_fstec
Circl	CVE-2021-35211	13 Jul 202103:58	–	circl
CISA KEV Catalog	SolarWinds Serv-U Remote Code Execution Vulnerability	3 Nov 202100:00	–	cisa_kev
CISA	SolarWinds Releases Advisory for Serv-U Vulnerability	13 Jul 202100:00	–	cisa
CNNVD	SolarWinds Serv-U FTP Server 缓冲区错误漏洞	13 Jul 202100:00	–	cnnvd
Check Point Advisories	SolarWinds Serv-U Remote Code Execution (CVE-2021-35211)	5 Dec 202100:00	–	checkpoint_advisories

02 Sep 2021 16:00Current

10High risk

Vulners AI Score10

EPSS0.9116