Critical severity flaw warning issued by CISA for SolarWinds Web Help Desk

News
By
published

A bug discovered last summer is being actively exploited

Red padlock open on electric circuits network dark red background
(Image credit: Shutterstock/Chor muang)

A critical vulnerability in a SolarWinds product is being abused in the wild, and now US government agencies have a deadline to patch it or lose it.

The US Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2024-28987 to its Known Exploited Vulnerabilities (KEV) catalog. When a vulnerability is added to this list, it means there is evidence of in-the-wild abuse.

This flaw resides in Web Help Desk, a web-based IT service management software that streamlines and automates help desk ticketing, asset management, and IT service management processes. It is considered one of SolarWinds’ most popular products, and offers things like ticketing, incident and problem management, and a self-service portal. IT support teams around the world are using this product every day.

Deadline to patch

The bug is the result of a simple oversight by the SolarWinds team - admin credentials were left hardcoded in Web Help Desk. That means that miscreants can access their targets’ endpoints easily, by logging in as an admin. This flaw carries a severity score of 9.1/10 and is deemed critical. It affects Web Help Desk 12.8.3 HF1 and all previous versions.

The earliest clean version is 12.8.3 HF2.

Since the patch is available, federal agencies have a three-week deadline (by November 5) to apply it. It needs to be applied manually, as there is no automatic solution. Alternatively, they can stop using the tool altogether.

Hardcoded credentials are a frequent occurrence. In October last year, for example, it was found that Cisco Emergency Responder (CER), the company’s emergency communication system used to respond to crises in a timely manner, had hardcoded credentials. In March 2024, researchers found that millions of GitHub projects had the same problem.

CISA did not detail who the crooks are, who they are targeting with this vulnerability, or how it is being exploited in the real world.

Via The Hacker News

More from TechRadar Pro

Sead Fadilpašić

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.