CVE-2024-28987

high-risk
Published 2024-08-21

The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.

Do I need to act?

!
94.3% chance of exploitation in next 30 days
EPSS score — higher than 6% of all CVEs
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.1/10 Critical
NETWORK / LOW complexity

Affected Products (3)

Affected Vendors

Solarwinds

References (4)

Release Notes https://support.solarwinds.com/SuccessCenter/s/article/SolarWinds-Web-Help-Desk-...
Vendor Advisory https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28987
Press/Media Coverage https://www.theregister.com/2024/08/22/hardcoded_credentials_bug_solarwinds_whd/
US Government Resource https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-...
67
/ 100
high-risk
Severity 31/34 · Critical
Exploitability 27/34 · High
Exposure 9/34 · Low