SB2025072888 - Multiple vulnerabilities in SolarWinds Platform 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2025072888

SB2025072888 - Multiple vulnerabilities in SolarWinds Platform

Published: July 28, 2025 Updated: August 1, 2025

Security Bulletin ID SB2025072888
Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 secuirty vulnerabilities.


1) Improper authentication (CVE-ID: CVE-2024-12797)

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to an error when using RFC7250 Raw Public Keys (RPKs) to authenticate a server. TLS and DTLS connections using raw public keys are vulnerable to man-in-middle attacks when server authentication failure is not detected by clients.

Note, the vulnerability can be exploited only when TLS clients explicitly enable RPK use by the server, and the server, likewise, enables sending of an RPK instead of an X.509 certificate chain.


2) Out-of-bounds write (CVE-ID: CVE-2024-9143)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when using the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial. A remote attacker can send specially crafted input to the server, trigger an out-of-bounds write and perform a denial of service (DoS) attack.

Note, the vulnerability can be exploited against the application in rare cases only that involve "exotic" curve encoding.


3) Covert Timing Channel (CVE-ID: CVE-2024-13176)

The vulnerability allows a remote attacker to recover a private key.

The vulnerability exists due to a timing side-channel in ECDSA signature computations. A remote attacker can recover the private key and decrypt data.

Successful exploitation of the vulnerability requires that the attacker's process must either be located in the same physical computer or must have a very fast network connection with low latency.


4) Deserialization of Untrusted Data (CVE-ID: CVE-2025-26397)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insecure input validation when processing serialized data in SolarWinds Observability component. A local user can pass specially crafted data to the application and execute arbitrary code with elevated privileges. 


Remediation

Install update from vendor's website.

References