CVE-2016-3643

SolarWinds Virtualization Manager 6.3.1 and earlier ship with a misconfigured sudo setting that allows any local user on the appliance to execute commands with elevated (root) privileges. An attacker who has obtained any low-privilege foothold on the appliance, for example via another flaw or a weak account, can abuse the overly permissive sudo configuration (demonstrated with 'sudo cat /etc/passwd') to run arbitrary commands as root. Successful exploitation yields full control of the virtual appliance, including its stored data and credentials. Any deployment running Virtualization Manager 6.3.1 or earlier is affected. The flaw has had public proof-of-concept code since 2016 and was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, indicating it has been exploited in the wild.

What to do: Upgrade Virtualization Manager to a release later than 6.3.1 per vendor instructions and verify the appliance's sudoers configuration no longer grants unrestricted root commands to low-privilege users. Because the flaw is on CISA's KEV list, prioritize patching internet-reachable appliances, restrict local shell access to trusted administrators, and review appliance logs and local accounts for signs of prior exploitation.