Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2021-35223: The Serv-U File Server allows for events such as user login failures to be audited by executing a command. This command can be supplied with parameters that can take the form of user string variabl...
CVE-2021-35223 · published 5 years ago
Summary
The Serv-U File Server allows for events such as user login failures to be audited by executing a command. This command can be supplied with parameters that can take the form of user string variables, allowing remote code execution.
What to do
- Update solarwinds serv-u to version 15.2.4 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| solarwinds | serv-u |
< 15.2.4 cpe:2.3:a:solarwinds:serv-u:*:*:*:*:*:*:*:* |
Original advisory text
The Serv-U File Server allows for events such as user login failures to be audited by executing a command. This command can be supplied with parameters that can take the form of user string variabl...
The Serv-U File Server allows for events such as user login failures to be audited by executing a command. This command can be supplied with parameters that can take the form of user string variables, allowing remote code execution.
References
- https://documentation.solarwinds.com/en/success_center/servu/content/release_not... Release Notes Vendor Advisory
- https://support.solarwinds.com/SuccessCenter/s/article/Execute-Command-Function-... Vendor Advisory
- https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35223 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-20Improper Input Validation
Timeline
Published31 Aug 2021
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2021-35223 · NVD
Track software like this
Free during beta