Threat actorhigh
SolarWinds Orion exploited by another group of state-sponsored hackers
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2021-25274+1 related CVE | The Collector Service in SolarWinds Orion Platform before 2020.2.4 uses MSMQ (Microsoft Message Queue) and doesn't set permissions on its private queues | 9.8 group max | 36% | PoC | |
| CVE-2021-25276 | In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' password hashes) that is world readable… | 7.1 | <1% | PoC |
From the original article
2 min read at helpnetsecurity.com
Another group of state-sponsored hackers has exploited the ubiquity of SolarWinds software to target US government agencies, Reuters reported on Tuesday. Unlike the alleged Russian attackers who inserted malware directly into the company’s Orion network monitoring platform by compromising its build environment , another group has simply found and exploited a vulnerability in the software.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.