rxerium/CVE-2025-26399

GitHubRepository PoCScanner

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Nuclei template that detects SolarWinds Web Help Desk instances vulnerable to CVE-2025-26399 by checking the version string extracted from the login page.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Nuclei detection template and a README. The template performs a read-only HTTP GET to identify SolarWinds Web Help Desk instances and extract a version string for comparison. No backdoor, deceptive payload, or concealed harmful behavior is present in the reviewed text.

ClassificationScanner
Model confidence95%
AuthenticationNot required
Languagesyaml
Target softwareSolarWinds Web Help Desk
Attack typesdetection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a Nuclei template that performs version-based detection of a vulnerable instance. It does not contain any code to exploit the deserialization vulnerability or execute commands; it only checks for the presence of the software and its version.

CVE-2025-26339.yaml:1-52README.md:5

Requirements

  • Target must be running SolarWinds Web Help Desk and expose the login page at /helpdesk/WebObjects/Helpdesk.woa.CVE-2025-26339.yaml:20

Observed behavior

  • Sends an HTTP GET request to the target's Helpdesk login page.CVE-2025-26339.yaml:18-20
  • Extracts a build token from the response body using a regex pattern.CVE-2025-26339.yaml:26-32
  • Converts the build token into a version string by replacing underscores with dots.CVE-2025-26339.yaml:35-38
  • Matches the response if it contains specific product identifiers and the extracted version is less than 12.8.7.0.CVE-2025-26339.yaml:40-52
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
{{BaseURL}}/helpdesk/WebObjects/Helpdesk.woaTarget path used by the Nuclei template to detect the application.CVE-2025-26339.yaml:20
Regex
\\?v=([0-9]+_[0-9]+_[0-9]+_[0-9]+)Regex used to extract a build token from the response body for version comparison.CVE-2025-26339.yaml:32
Dsl Expression
compare_versions(version, '<12.8.7.0')Version check that flags instances older than the patched release.CVE-2025-26339.yaml:52
Review boundaries

What the analysis did not establish

  • One file (likely .gitignore or similar) was omitted from the packet; its content is not available for analysis.
  • The evidence does not include any exploit code or proof of exploitation, only a detection template.
  • One file (metadata only, not supplied as text) was omitted from the evidence packet and was not reviewed.
  • Binary content was not present; the analysis covers only the supplied readable text.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1