CVE-2025-40551
SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability
In short
SolarWinds Web Help Desk can be hacked remotely without a password because it unsafely processes untrusted data, allowing attackers to run commands on the server.
Technical detail
The application deserializes untrusted input without validation (CWE-502), enabling unauthenticated remote code execution via crafted serialized objects. An attacker can exploit this network-accessible vulnerability to achieve arbitrary command execution on the host with the application's privileges.
Summary generated and translated by AI from the official description.
SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
SolarWinds · Web Help DeskWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →