Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

SolarWinds Log and Event Manager code execution via ping

CVE-2015-7840 · published 11 years ago
Summary

The command line console in SolarWinds Log and Event Manager up to version 6.1 can be tricked into running unwanted programs when the ping feature is used. An attacker on the network could cause the software to execute their own code, potentially compromising the system. Update to version 6.2 or later to stop the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
solarwinds log_and_event_manager <= 6.1
cpe:2.3:a:solarwinds:log_and_event_manager:*:*:*:*:*:*:*:*
Original advisory text
The command line management console (CMC) in SolarWinds Log and Event Manager (LEM) before 6.2.0 allows remote attackers to execute arbitrary code via unspecified vectors involving the ping feature.
The command line management console (CMC) in SolarWinds Log and Event Manager (LEM) before 6.2.0 allows remote attackers to execute arbitrary code via unspecified vectors involving the ping feature.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
4% chance of attack within 30 days
Type
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published15 Oct 2015
Updated25 Oct 2026
First seen29 Sep 2026
Sources
CVE-2015-7840 · NVD
Track software like this
Free during beta