CVE-2021-25275: Use of Hard-coded Credentials

SolarWinds Orion Platform before 2020.2.4, as used by various SolarWinds products, installs and uses a SQL Server backend, and stores database credentials to access this backend in a file readable by unprivileged users. As a result, any user having access to the filesystem can read database login...

PT-2021-16497

Name of the Vulnerable Software and Affected Versions: SolarWinds Serv-U versions prior to 15.2.2 Hotfix 1 Description: The issue concerns a directory containing user profile files, including password hashes, which is world readable and writable. An unprivileged Windows user with access to the...

PT-2021-11772

Name of the Vulnerable Software and Affected Versions: SolarWinds Serv-U versions prior to 15.2.2 Description: The issue allows for Unauthenticated Macro Injection. Recommendations: For versions prior to 15.2.2, update to version 15.2.2 or later to resolve the issue...

CVE-2020-35481: Undefined Security Weakness

SolarWinds Serv-U before 15.2.2 allows Unauthenticated Macro Injection...

CVE-2021-25276: Incorrect Permission Assignment for Critical Resource

In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files that include users' password hashes that is world readable and writable. An unprivileged Windows user having access to the server's filesystem can add an FTP user by copying a valid profile file to thi...

Serious vulnerabilities fixed in SolarWinds Orion

Vulnerabilities have been fixed in SolarWinds Orion. The vulnerability with reference CVE-2021-25274 allows an unauthenticated remote malicious person to execute arbitrary code with SYSTEM privileges. The vulnerability with attribute CVE-2021-25275 allows a local malicious person to access...

SolarWinds Hack Prompts Congress to Put NSA in Encryption Hot Seat

Members of Congress are demanding the U.S. National Security Agency NSA reveal what it knows about the 2015 Juniper Networks supply-chain delivery breach. In a letter sent by U.S. Senator Ron Wyden and nine additional members of Congress, the lawmakers demand a full account of the NSA-designed...

Addressing the OT-IT Risk and Asset Inventory Gap

Cyber-espionage and exploitation from nation-state-sanctioned actors have only become more prevalent in recent years, with recent examples including the SolarWinds attack, which was attributed to nation-state actors with alleged Russian ties. There are suspicions that sensitive information has be...

The SolarWinds Attack

SolarWinds attack explained by Wiz CTO Ami Luttwak...

LIVE Webinar: Major Lessons to be Learned from Top Cyber Attacks in 2020

We likely all agree that 2020 was a year we won't soon forget - for many reasons. One area particularly impacted last year was and continues to be cybersecurity. While Internet access allowed many businesses to continue functioning during the COVID-19 stay at home requirements, the unprecedented...

LIVE Webinar: Major Lessons to be Learned from Top Cyber Attacks in 2020

We likely all agree that 2020 was a year we won't soon forget - for many reasons. One area particularly impacted last year was and continues to be cybersecurity. While Internet access allowed many businesses to continue functioning during the COVID-19 stay at home requirements, the unprecedented...

Talos Takes Ep. #39: SolarWinds' implications for IoT and OT

The latest episode of Talos Takes is available now. Download this episode and subscribe to Talos Takes using the buttons below, or visit the Talos Takes page. This week, we're continuing our deep dive into the SolarWinds campaign. After Nick Biasini gave us a broad overview of supply chain attack...

Mimecast Confirms SolarWinds Hack as List of Security Vendor Victims Snowball

The Mimecast certificate compromise reported earlier in January is part of the sprawling SolarWinds supply-chain attack, the security firm has confirmed. Mimecast joins other cybersecurity vendors like CrowdStrike, Fidelis, FireEye, Malwarebytes, Palo Alto Networks and Qualys in being targeted in...

In the Wake of the SolarWinds Hack, Here's How Businesses Should Respond

Throughout 2020, businesses, in general, have had their hands full with IT challenges. They had to rush to accommodate a sudden shift to remote work. Then they had to navigate a rapid adoption of automation technologies. And as the year came to a close, more businesses began trying to assemble th...

In the Wake of the SolarWinds Hack, Here's How Businesses Should Respond

Throughout 2020, businesses, in general, have had their hands full with IT challenges. They had to rush to accommodate a sudden shift to remote work. Then they had to navigate a rapid adoption of automation technologies. And as the year came to a close, more businesses began trying to assemble th...

CISA Malware Analysis on Supernova

CISA has released a malware analysis report on Supernova malware affecting unpatched SolarWinds Orion software. The report contains indicators of compromise IOCs and analyzes several malicious artifacts. Supernova is not part of the SolarWinds supply chain attack described in Alert AA20-352A. CIS...

North Korea Targets Security Researchers in Elaborate 0-Day Campaign

Hackers linked to North Korea are targeting security researchers with an elaborate social-engineering campaign that sets up trusted relationships with them — and then infects their organizations’ systems with custom backdoor malware. That’s according to Google’s Threat Analysis Group TAG, which...

Breaking Down Joe Biden's $10B Cybersecurity 'Down Payment'

President Joe Biden laid out a series of cybersecurity initiatives last week at his inauguration, including earmarking $10 billion for various cybersecurity defense initiatives. Those included hiring key security personnel to support for the Cybersecurity Infrastructure Security Agency CISA. The...

PT-2021-11431

Name of the Vulnerable Software and Affected Versions: SolarWinds Network Performance Monitor versions 2020 HF1, 2020.2 Description: This issue allows remote attackers to escalate privileges on affected installations. Authentication is required to exploit this issue. The specific flaw exists with...

Talos Takes Ep. #37: What's with all this talk about supply chain attacks?

The latest episode of Talos Takes is available now. Download this episode and subscribe to Talos Takes using the buttons below, or visit the Talos Takes page. The major SolarWinds campaign has been generating headlines for weeks now. And while its specific targets make this attack unique, this is...