Product:
Serv-U
Summary
A logic error vulnerability exists in Serv-U which when abused could give a malicious actor with access to admin privileges the ability to execute code. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.1 | CVE-2025-40547 |
Exploitation
To exploit this vulnerability, an attacker must have administrative privileges on the affected system. Once access is gained, the attacker can manipulate the logic error to execute arbitrary code, potentially leading to a full system compromise. The attack can be conducted over the network, making it accessible to remote attackers.
Affected Products
- Serv-U: Affected by the logic error vulnerability allowing code execution with admin privileges.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security updates provided by SolarWinds. Additionally, organizations should review their administrative access policies and limit the number of users with admin privileges to reduce the risk of exploitation.