Product:
Serv-U
Summary
A type confusion vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to execute arbitrary native code as privileged account. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.1 | CVE-2025-40540 |
Exploitation
To exploit this vulnerability, an attacker must have administrative privileges. Once these privileges are obtained, the attacker can manipulate the type confusion flaw to execute arbitrary native code, potentially leading to full system compromise. The attack can be executed over the network, making it accessible to remote attackers.
Affected Products
- Serv-U: Affected by the type confusion vulnerability allowing arbitrary code execution.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security updates provided by SolarWinds. Additionally, users should review their service account configurations to ensure that services are running with the least privileges necessary to reduce the risk of exploitation.