Advisory Details

September 20th, 2021

SolarWinds Network Performance Monitor ExecuteExternalProgram Command Injection Remote Code Execution Vulnerability

CVE ID	CVE-2020-14005
CVSS SCORE	8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AFFECTED VENDORS	SolarWinds
AFFECTED PRODUCTS	Network Performance Monitor
VULNERABILITY DETAILS	This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Network Performance Monitor. Authentication is required to exploit this vulnerability. The specific flaw exists within the ExecuteExternalProgram method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of system.
ADDITIONAL DETAILS	Fixed in Orion Platform 2020.2.1 Hot Fix 2 - released on 12/15/2020
DISCLOSURE TIMELINE	2020-09-30 - Vulnerability reported to vendor 2021-09-20 - Coordinated public release of advisory 2022-05-26 - Advisory Updated
CREDIT	Piotr Bazydlo (@chudypb)

BACK TO ADVISORIES