CVE-2021-35211criticalunder attackransomwareCWE-787

CVE-2021-35211: critical vulnerability in SolarWinds Serv-U Managed File Transfer Server…

Serv-U Remote Memory Escape Vulnerability

Published · Updated

Follow this CVE+ Monitor Serv-U+ Monitor Serv-U Managed File Transfer Server and Serv-U Secured FTP

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has a working public exploit and 1 threat group(s) use it.

ssvc Actcvss 9epss 91%
from disclosure to weapon78 days
Published on NVDJul 14
1st PoC+78d
CISA KEV+112d
Who exploits it — 1

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

Ransomwareclop ransomware.live
Action required by CISAfederal deadline: 2021-11-17

Apply updates per vendor instructions.

In short

A critical flaw in SolarWinds Serv-U allows attackers to execute arbitrary code remotely on servers running the software, potentially giving them full control of the machine. This vulnerability affects older versions of Serv-U on Windows and requires immediate patching to prevent exploitation.

Technical detail

CVE-2021-35211 is a remote code execution vulnerability (CWE-787: Out-of-bounds Write) in SolarWinds Serv-U versions before 15.2.3 HF2 on Windows. An unauthenticated remote attacker can trigger a memory escape condition to execute arbitrary code with elevated privileges on the affected host. The vulnerability has a CVSS score of 9.0, indicating critical severity and high exploitability.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 are affected by this vulnerability.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
SolarWinds · Serv-U Managed File Transfer Server and Serv-U Secured FTP
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.