CVE-2020-12608
28Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendepss 22%
from disclosure to weapon4 days
Published on NVDMay 7
1st PoC+4d
exploitation probability
22%top 3% of all CVEs
observed exploitation
nono source reports it
2 public exploit(s)
An issue was discovered in SolarWinds MSP PME (Patch Management Engine) Cache Service before 1.1.15 in the Advanced Monitoring Agent. There are insecure file permissions for %PROGRAMDATA%\SolarWinds MSP\SolarWinds.MSP.CacheService\config\. This can lead to code execution by changing the CacheService.xml SISServerURL parameter.
Affected products
n/a · n/apublic PoCs found — 2
cve_referencepacketstormsecurity.com/files/157591/SolarWinds-MSP-PME-Cache-Service-Insecure-File-Permissions-Code-Execution.htmlunverifiedexploitdbwww.exploit-db.com/exploits/48448unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.