Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2024-28989: Weak Encryption Key Management in Solar Winds Web Help Desk

netspi.com | vulnerability | CVE-2024-28989 | #encryption | #solarwinds | #aes-gcm | #web-help-desk | #cve-2024-28989 | #password-recovery

Summary

CVE-2024-28989: SolarWinds Web Help Desk uses predictable AES-GCM keys—some static, some from a restricted keyspace—so an attacker with a backup file can recover stored passwords. Fixed in 12.8.5.
CVE
CVE-2024-28989
Published
Collected

original ↗

Related coverage

vulnerability · netspi.com
CVE-2025-26399 SolarWinds Web Help Desk Overview and Takeaways
CVE-2025-26399 is a critical unauthenticated deserialization flaw (CVSS 9.8) in SolarWinds Web Help Desk, a patch bypass now actively exploited and listed in CISA's KEV catalog.
vulnerability · bishopfox.com
Signature Optional - Analysis of CVE-2026-28323
CVE-2026-28323 is a CVSS 9.8 SAML auth bypass in SolarWinds Web Help Desk. A single forged POST request grants unauthenticated access to any valid account.
vulnerability · netspi.com
Set Sail: Remote Code Execution in SailPoint IQService via Default Encryption Key
SailPoint IQService before the May 2025 update allows RCE with default settings: the RPC server uses a hard-coded key without authentication or TLS, letting attackers execute arbitrary code.
vulnerability · bishopfox.com
Master Key Included: Detecting SolarWinds ARM CVE-2026-28326
CVE-2026-28326 is an unauthenticated RCE in SolarWinds ARM where a hardcoded shared secret on TCP 55555 leads to SYSTEM-level code execution. Patch now.
vulnerability · bishopfox.com
SolarWinds Log & Event Manager - Improper Access Control
Advisory for improper access control in SolarWinds LEM (CVE-2017-7646): via nano in restricted mode, an authenticated user could browse the appliance filesystem and read the admin password hash.
vulnerability · bishopfox.com
SolarWinds Log & Event Manager - Arbitrary Command Injection
Advisory for an arbitrary command injection in SolarWinds Log & Event Manager (CVE-2017-7647): an authenticated user could escape the CMC console and run commands as root; fixed in 6.3.1 HF4.
back