SolarWinds Issues Patch for Critical ARM Vulnerability Enabling RCE Attacks – OfficialSarkar

ByOfficial Sarkar

Sep 17, 2024Ravie LakshmananSoftware Security / Data Protection

SolarWinds

SolarWinds has released fixes to address two security flaws in its Access Rights Manager (ARM) software, including a critical vulnerability that could result in remote code execution.

The vulnerability, tracked as CVE-2024-28991, is rated 9.0 out of a maximum of 10.0 on the CVSS scoring system. It has been described as an instance of deserialization of untrusted data.

“SolarWinds Access Rights Manager (ARM) was found to be susceptible to a remote code execution vulnerability,” the company said in an advisory. “If exploited, this vulnerability would allow an authenticated user to abuse the service, resulting in remote code execution.”

Security researcher Piotr Bazydlo of the Trend Micro Zero Day Initiative (ZDI) has been credited with discovering and reporting the flaw on May 24, 2024.

The ZDI, which has assigned the shortcoming a CVSS score of 9.9, said it exists within a class called JsonSerializationBinder and stems from a lack of proper validation of user-supplied data, thus exposing ARM devices to a deserialization vulnerability that could then be abused to execute arbitrary code.

Cybersecurity

“Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed,” the ZDI said.

Also addressed by SolarWinds is a medium-severity flaw in ARM (CVE-2024-28990, CVSS score: 6.3) that exposed a hard-coded credential which, if successfully exploited, could allow unauthorized access to the RabbitMQ management console.

Both the issues have been patched in ARM version 2024.3.1. Although there is currently no evidence of active exploitation of the vulnerabilities, users are recommended to update to the latest version as soon as possible to safeguard against potential threats.

The development comes as D-Link has resolved three critical vulnerabilities affecting DIR-X4860, DIR-X5460, and COVR-X1870 routers (CVE-2024-45694, CVE-2024-45695, and CVE-2024-45697, CVSS scores: 9.8) that could enable remote execution of arbitrary code and system commands.

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.

Source: TheHackerNews

Similar Posts

China Accuses U.S. of Fabricating Volt Typhoon to Hide Its Own Hacking Campaigns – OfficialSarkar

China Accuses U.S. of Fabricating Volt Typhoon to Hide Its Own Hacking Campaigns – OfficialSarkar

ByOfficial Sarkar

China’s National Computer Virus Emergency Response Center (CVERC) has doubled down on claims that the threat actor known as the Volt Typhoon is a fabrication of the U.S. and its allies. The agency, in collaboration with the National Engineering Laboratory for Computer Virus Prevention Technology, went on to accuse the U.S. federal government, intelligence agencies,…

CRYSTALRAY Hackers Infect Over 1,500 Victims Using Network Mapping Tool – OfficialSarkar

CRYSTALRAY Hackers Infect Over 1,500 Victims Using Network Mapping Tool – OfficialSarkar

ByOfficial Sarkar

Jul 15, 2024NewsroomSaaS Security / Vulnerability A threat actor that was previously observed using an open-source network mapping tool has greatly expanded their operations to infect over 1,500 victims. Sysdig, which is tracking the cluster under the name CRYSTALRAY, said the activities have witnessed a 10x surge, adding it includes “mass scanning, exploiting multiple vulnerabilities,…

APT41 Hackers Use ShadowPad, Cobalt Strike in Taiwanese Institute Cyber Attack – OfficialSarkar

APT41 Hackers Use ShadowPad, Cobalt Strike in Taiwanese Institute Cyber Attack – OfficialSarkar

ByOfficial Sarkar

Aug 02, 2024Ravie LakshmananCyber Espionage / Malware A Taiwanese government-affiliated research institute that specializes in computing and associated technologies was breached by nation-state threat actors with ties to China, according to new findings from Cisco Talos. The unnamed organization was targeted as early as mid-July 2023 to deliver a variety of backdoors and post-compromise tools…

U.S. and Allies Warn of Iranian Cyberattacks on Critical Infrastructure in Year-Long Campaign – OfficialSarkar

U.S. and Allies Warn of Iranian Cyberattacks on Critical Infrastructure in Year-Long Campaign – OfficialSarkar

ByOfficial Sarkar

Oct 18, 2024Ravie LakshmananCyber Intelligence / Critical Infrastructure Cybersecurity and intelligence agencies from Australia, Canada, and the U.S. have warned about a year-long campaign undertaken by Iranian cyber actors to infiltrate critical infrastructure organizations via brute-force attacks. “Since October 2023, Iranian actors have used brute force and password spraying to compromise user accounts and obtain…

Critical NVIDIA Container Toolkit Vulnerability Could Grant Full Host Access to Attackers – OfficialSarkar

Critical NVIDIA Container Toolkit Vulnerability Could Grant Full Host Access to Attackers – OfficialSarkar

ByOfficial Sarkar

Sep 27, 2024Ravie LakshmananContainer Security / Cloud Computing A critical security flaw has been disclosed in the NVIDIA Container Toolkit that, if successfully exploited, could allow threat actors to break out of the confines of a container and gain full access to the underlying host. The vulnerability, tracked as CVE-2024-0132, carries a CVSS score of…

Seven Bolt-Ons to Make Your Entra ID More Secure for Critical Sessions – OfficialSarkar

Seven Bolt-Ons to Make Your Entra ID More Secure for Critical Sessions – OfficialSarkar

ByOfficial Sarkar

Dec 09, 2024The Hacker NewsIdentity Security / Passwordless Identity security is all the rage right now, and rightfully so. Securing identities that access an organization’s resources is a sound security model. But IDs have their limits, and there are many use cases when a business should add other layers of security to a strong identity….

Leave a Reply

Your email address will not be published. Required fields are marked *