CVE-2020-25618

HIGH

SolarWinds N-Central 12.3.0.670 - OS Command Injection via Sudo Misconfiguration

Title source: llm
STIX 2.1

Description

An issue was discovered in SolarWinds N-Central 12.3.0.670. The sudo configuration has incorrect access control because the nable web user account is effectively able to run arbitrary OS commands as root (i.e., the use of root privileges is not limited to specific programs listed in the sudoers file).

References (3)

Core 3
Core References
Vendor Advisory x_refsource_misc
https://support.solarwinds.com/SuccessCenter/s/
Third Party Advisory x_refsource_misc
https://ernw.de/en/publications.html

Scores

CVSS v3 8.8
EPSS 0.0263
EPSS Percentile 85.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-78
Status published
Products (1)
solarwinds/n-central 12.3.0.670
Published Dec 16, 2020
Tracked Since Feb 18, 2026