SolarWinds Releases Update for Critical ARM Vulnerability Enabling Remote Code Execution Attacks

Sep 17, 2024Ravie LakshmananSoftware Security / Data Protection

SolarWinds has rolled out solutions to rectify two security vulnerabilities in its Access Rights Manager (ARM) software, which includes a critical flaw that could lead to remote code

Sep 17, 2024Ravie LakshmananSoftware Security / Data Protection

SolarWinds Issues Patch for Critical ARM Vulnerability Enabling RCE Attacks

SolarWinds has rolled out solutions to rectify two security vulnerabilities in its Access Rights Manager (ARM) software, which includes a critical flaw that could lead to remote code execution.

The vulnerability identified as CVE-2024-28991, has a CVSS score of 9.0 out of 10.0, indicating its severity. It has been characterized as a case of untrusted data deserialization.

“An issue was discovered in the SolarWinds Access Rights Manager (ARM) that could potentially lead to a remote code execution scenario,” the company informed in a statement. “In case of exploitation, this flaw would empower an authorized user to misuse the service, ultimately resulting in remote code execution.”

Security analyst Piotr Bazydlo from the Trend Micro Zero Day Initiative (ZDI) received credit for uncovering and reporting this vulnerability on May 24, 2024.

The ZDI has given this flaw a CVSS score of 9.9, highlighting that it originates from a lack of proper validation of user-input data within a class named JsonSerializationBinder, consequently making ARM devices vulnerable to a deserialization exploit that could be utilized for executing arbitrary code.

“While authentication is a prerequisite for exploiting this flaw, it is possible to circumvent the current authentication mechanism,” as mentioned by the ZDI in this communication.

SolarWinds has also fixed a medium-risk vulnerability in ARM (CVE-2024-28990, CVSS score: 6.3) that exposed a hardcoded credential capable of granting unauthorized access to the RabbitMQ management console if exploited successfully.

Both these issues have been addressed in version 2024.3.1 of ARM. Although no active exploitation of these vulnerabilities has been reported, it is advisable for users to promptly update to the latest version to shield themselves against possible threats.

This news coincides with D-Link resolving three critical vulnerabilities affecting DIR-X4860, DIR-X5460, and COVR-X1870 routers (CVE-2024-45694, CVE-2024-45695, and CVE-2024-45697, CVSS scores: 9.8) allowing for remote execution of unauthorized code and system commands.

Enjoyed this read? Connect with us on Twitter and LinkedIn for more exclusive content.

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts