CVE-2023-35179
HighCVSS 7.2Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
A vulnerability has been identified within Serv-U 15.4 that allows bypassing multi-factor/two-factor authentication. The actor must have administrator-level access to Serv-U to perform this action.
Risk Assessment
Bypassing authentication could lead to unauthorized access to the system, posing a serious security threat to the organization.
Recommendation
It is recommended to restrict access to administrator accounts and update the software to the latest version to minimize risk.
Other vulnerabilities in Serv-U 15.4
See all- CVE-2025-40549Critical
Serv-U contains a Path Restriction Bypass vulnerability that, when abused, could give a malicious actor with admin privileges the ability to execute code on a directory. This issue requires administrative privileges to abuse. On Windows systems, this is scored as medium due to differences in how paths and home directories are handled.
- CVE-2025-40548Critical
Serv-U contains a missing validation process vulnerability that, when abused, could give a malicious actor with admin privileges the ability to execute code. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as medium because services frequently run under less-privileged service accounts by default.
- CVE-2025-40547Critical
Serv-U contains a logic error vulnerability that, when abused, could give a malicious actor with admin privileges the ability to execute code. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as medium because services frequently run under less-privileged service accounts by default.
Original NVD description (English source)
A vulnerability has been identified within Serv-U 15.4 that, if exploited, allows an actor to bypass multi-factor/two-factor authentication. The actor must have administrator-level access to Serv-U to perform this action.