Skip to main content

Government officials will never ask you to transfer money or disclose bank log-in details over a phone call.

Call the 24/7 ScamShield Helpline at 1799 if you are unsure if something is a scam.

Cyber Security Agency of Singapore
Alerts

Critical Vulnerabilities in SolarWinds ARM Product

19 February 2024

SolarWinds has released security updates to address critical vulnerabilities (CVE-2023-40057, CVE-2024-23476 and CVE-2024-23479) impacting their Access Rights Manager (ARM) product.

The critical vulnerabilities are:

  • CVE-2023-40057: Successful exploitation of the input validation vulnerability may allow an authenticated attacker to abuse a SolarWinds service to perform remote code execution

  • CVE-2024-23476: Successful exploitation of the directory traversal vulnerability may allow an unauthenticated attacker to perform remote code execution

  • CVE-2024-23479: Successful exploitation of the directory traversal vulnerability may allow an unauthenticated attacker to perform remote code execution

The vulnerabilities affect SolarWinds ARM versions 2023.2 and earlier.

Users and administrators of affected product versions are advised to update to the latest version immediately.

More information is available here:

https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2023-2-3_release_notes.htm

https://www.bleepingcomputer.com/news/security/solarwinds-fixes-critical-rce-bugs-in-access-rights-audit-solution/

Back to top