RSS   Vulnerabilities for 'N-central'   RSS

2020-12-16
 
CVE-2020-25622

CWE-352
 

 
An issue was discovered in SolarWinds N-Central 12.3.0.670. The AdvancedScripts HTTP endpoint allows CSRF.

 
 
CVE-2020-25621

CWE-287
 

 
An issue was discovered in SolarWinds N-Central 12.3.0.670. The local database does not require authentication: security is only based on ability to access a network interface. The database has keys and passwords.

 
 
CVE-2020-25620

CWE-798
 

 
An issue was discovered in SolarWinds N-Central 12.3.0.670. Hard-coded Credentials exist by default for local user accounts named support@n-able.com and nableadmin@n-able.com. These allow logins to the N-Central Administrative Console (NAC) and/or the regular web interface.

 
 
CVE-2020-25619

NVD-CWE-Other
 

 
An issue was discovered in SolarWinds N-Central 12.3.0.670. The SSH component does not restrict the Communication Channel to Intended Endpoints. An attacker can leverage an SSH feature (port forwarding with a temporary key pair) to access network services on the 127.0.0.1 interface, even though this feature was only intended for user-to-agent communication.

 
 
CVE-2020-25618

CWE-78
 

 
An issue was discovered in SolarWinds N-Central 12.3.0.670. The sudo configuration has incorrect access control because the nable web user account is effectively able to run arbitrary OS commands as root (i.e., the use of root privileges is not limited to specific programs listed in the sudoers file).

 
 
CVE-2020-25617

CWE-22
 

 
An issue was discovered in SolarWinds N-Central 12.3.0.670. The AdvancedScripts HTTP endpoint allows Relative Path Traversal by an authenticated user of the N-Central Administration Console (NAC), leading to execution of OS commands as root.

 
2020-01-26
 
CVE-2020-7984

CWE-319
 

 
SolarWinds N-central before 12.1 SP1 HF5 and 12.2 before SP1 HF2 allows remote attackers to retrieve cleartext domain admin credentials from the Agent & Probe settings, and obtain other sensitive information. The attacker can use a customer ID to self register and read any aspects of the agent/appliance configuration.

 

 >>> Vendor: Solarwinds 46 Products
Tftp server
Orion network performance monitor
Ip address manager web interface
Network configuration manager
Log and event manager
Server and application monitor
Orion ip address manager
Orion netflow traffic analyzer
Orion network configuration manager
Orion server and application manager
Orion user device tracker
Orion voip & network quality manager
Orion web performance monitor
Firewall security manager
Storage manager
N-able n-central
Storage resource monitor
Virtualization manager
Ftp voyager
Log & event manager
Network performance monitor
Serv-u
Sftp/scp server
Orion platform
Serv-u ftp server
Damewire mini remote control
Database performance analyzer
Dameware mini remote control firmware
Dameware remote support
N-central
Netpath
Serv-u managed file transfer
Dameware
Managed service provider patch management engine
Advanced monitoring agent
Help desk
Webhelpdesk
Web help desk
Patch manager
Orion virtual infrastructure monitor
Serv-u file server
Dameware mini remote control
Pingdom
Kiwi cattools
Kiwi syslog server
Access rights manager


Copyright 2022, cxsecurity.com

 

Back to Top