Product:
Serv-U
Summary
A type confusion vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to execute arbitrary native code as privileged account. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.1 | CVE-2025-40539 |
Exploitation
To exploit this vulnerability, an attacker must have administrative privileges. Once these privileges are obtained, the attacker can manipulate the type confusion to execute arbitrary native code, potentially leading to a full system compromise. The attack can be performed over the network, making it accessible to remote attackers.
Affected Products
- Serv-U: Affected by a type confusion vulnerability allowing arbitrary code execution.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security updates provided by SolarWinds. Additionally, users should review their service account configurations to ensure that services are not running with excessive privileges, thereby reducing the risk of exploitation.