Skip to main content
A Singapore Government Agency Website How to identify
Official website links end with .gov.sg
Secure websites use HTTPS
Look for a lock () or https:// as an added precaution. Share sensitive information only on official, secure websites.
Government officials will never ask you to transfer money or disclose bank log-in details over a phone call.

Call the 24/7 ScamShield Helpline at 1799 if you are unsure if something is a scam.

Cyber Security Agency of Singapore
Alerts

Zero-Day Vulnerability in SolarWinds Serv-U (CVE-2021-35211)

13 July 2021

SolarWinds has released a security update to address a zero-day vulnerability (CVE-2021-35211) in their Serv-U Managed File Transfer and Serv-U Secure File Transfer Protocol (FTP) products. There are reports that the vulnerability is being exploited in the wild.

The vulnerability exists in the latest Serv-U version 15.2.3 hotfix (HF) 1 released 5 May 2021, and all prior versions. It only affects servers with Secure Shell (SSH) enabled.

Successful exploitation of the vulnerability could allow an attacker to run arbitrary code, view/change/delete data, or run programs on the affected system.

SolarWinds has released Serv-U version 15.2.3 HF2 to address the vulnerability.

Administrators and users of the affected products are advised to install the hotfix immediately. They are also encouraged to check if their environment has been compromised, by referring to the FAQ section in SolarWinds’ Security Advisory [1].

More information is available here:
[1] https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211 (opens in new tab)

[2] https://www.zdnet.com/article/solarwinds-releases-security-advisory-after-microsoft-says-customer-targeted-through-vulnerability/ (opens in new tab)

[3] https://www.bleepingcomputer.com/news/security/solarwinds-patches-critical-serv-u-vulnerability-exploited-in-the-wild/ (opens in new tab)