CVE-2017-7647

High

Published: 10/04/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

SolarWinds Log & Event Manager (LEM) before 6.3.1 Hotfix 4 allows an authenticated user to execute arbitrary commands.

Risk Assessment

The ability for an authenticated user to execute arbitrary commands poses a significant security risk to the system, potentially leading to unauthorized access to data or systems.

Recommendation

It is recommended to upgrade to version 6.3.1 Hotfix 4 or later to mitigate this vulnerability.

Other vulnerabilities in SolarWinds Log & Event Manager (LEM)

CVE-2017-7722Critical
In SolarWinds Log & Event Manager (LEM) before version 6.3.1 Hotfix 4, accessing the menu system via the SSH service with default credentials 'cmc' and 'password' allows an attacker to exploit a vulnerability in the restrictssh feature. This enables the attacker to escape from the restricted shell.

Original NVD description (English source)

SolarWinds Log & Event Manager (LEM) before 6.3.1 Hotfix 4 allows an authenticated user to execute arbitrary commands.