Product:
Serv-U
Summary
An Insecure Direct Object Reference (IDOR) vulnerability exists in Serv-U, which when exploited, gives a malicious actor the ability to execute native code as a privileged account. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.1 | CVE-2025-40541 |
Exploitation
To exploit this vulnerability, an attacker must have administrative privileges. Once they gain access, they can manipulate the application to execute native code, potentially leading to unauthorized access and control over the system. The attack can be performed over the network, making it accessible to remote attackers.
Affected Products
- Serv-U: Affected by IDOR vulnerability allowing execution of native code with administrative privileges.
Mitigation
To mitigate this vulnerability, it is essential to apply the latest security patches provided by SolarWinds. Additionally, review and restrict administrative privileges to only those users who absolutely need them. Regularly monitor and audit access logs to detect any unauthorized attempts to exploit this vulnerability.