Product:
Serv-U
Summary
A broken access control vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to create a system admin user and execute arbitrary code as a privileged account via domain admin or group admin privileges. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.1 | CVE-2025-40538 |
Exploitation
To exploit this vulnerability, an attacker must have administrative privileges. Once these privileges are obtained, the attacker can create a system admin user, allowing them to execute arbitrary code with elevated privileges. This can lead to a complete compromise of the affected system.
Affected Products
- Serv-U: Affected by broken access control allowing unauthorized admin user creation.
Mitigation
To mitigate this vulnerability, it is essential to ensure that administrative privileges are tightly controlled and monitored. Regular audits of user accounts and permissions can help prevent unauthorized access. Additionally, applying the latest security patches from SolarWinds is crucial to protect against this and other vulnerabilities.