Ò»¡¢Îó²î¸ÅÊö
Îó²îÃû³Æ | SolarWinds Web Help Desk ·´ÐòÁл¯RCEÎó²î |
CVE ID | CVE-2025-26399 |
Îó²îÀàÐÍ | RCE | ·¢Ã÷ʱ¼ä | 2025-09-24 |
Îó²îÆÀ·Ö | 9.8 | Îó²îÆ·¼¶ | ÑÏÖØ |
¹¥»÷ÏòÁ¿ | ÍøÂç | ËùÐèȨÏÞ | ÎÞ |
ʹÓÃÄÑ¶È | µÍ | Óû§½»»¥ | ²»ÐèÒª |
PoC/EXP | ÒѹûÕæ | ÔÚҰʹÓà | δ·¢Ã÷ |
SolarWinds Web Help Desk ÊÇÒ»¿î»ùÓÚWebµÄITЧÀÍÖÎÀíÓ빤µ¥ÏµÍ³£¬£¬£¬£¬ÆÕ±éÓ¦ÓÃÓÚÆóÒµÓë»ú¹¹µÄITÖ§³Ö³¡¾°¡£¡£¡£¡£¡£¸Ã²úÆ·Ö§³Ö×Ô¶¯»¯¹¤µ¥·ÖÅÉ¡¢×ʲúÖÎÀí¡¢ÖªÊ¶¿âÕûºÏ¼°Ð§ÀÍÇëÇó×·×Ù£¬£¬£¬£¬×ÊÖúÌáÉýITÔËάЧÂÊÓëÓû§Öª×ã¶È¡£¡£¡£¡£¡£ÆäÌṩ¶àƽ̨֧³ÖºÍÎÞа¼¯³ÉÄÜÁ¦£¬£¬£¬£¬±ãÓÚ¼¯Öл¯ÖÎÀíºÍ¿ìËÙÏìÓ¦¡£¡£¡£¡£¡£
2025Äê9ÔÂ24ÈÕ£¬£¬£¬£¬ÄϹ¬NGÓéÀÖ¼¯ÍÅVSRC¼à²âµ½SolarWinds Web Help Desk±£´æ·´ÐòÁл¯RCEÎó²î¡£¡£¡£¡£¡£¹¥»÷Õß¿ÉÔÚÎÞÐèÈÏÖ¤ÏÂÌá½»¶ñÒâÐòÁл¯Êý¾Ý£¬£¬£¬£¬´¥·¢·´ÐòÁл¯²¢Ö´ÐÐí§ÒâÏÂÁ£¬£¬£¬µ¼ÖÂÖ÷»ú±»¿ØÖÆ¡£¡£¡£¡£¡£¸ÃÎó²îÈƹýÁËÏÈÇ°²¹¶¡£¡£¡£¡£¡£¨CVE-2024-28988¡úCVE-2024-28986£©¡£¡£¡£¡£¡£Îó²îÆÀ·Ö9.8£¬£¬£¬£¬Îó²î¼¶±ðÑÏÖØ¡£¡£¡£¡£¡£
¶þ¡¢Ó°Ïì¹æÄ£
SolarWinds Web Help Desk <= 12.8.7
Èý¡¢Çå¾²²½·¥
3.1 Éý¼¶°æ±¾
ÒÑÐû²¼ÐÞ¸´°æ±¾£¬£¬£¬£¬Ç뽫SolarWinds Web Help DeskÉý¼¶µ½12.8.7 HF1¡£¡£¡£¡£¡£
ÏÂÔØÁ´½Ó£ºhttps://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7-hotfix-1_release_notes.htm/
3.2 ÔÝʱ²½·¥
ÔÝÎÞ¡£¡£¡£¡£¡£
3.3 ͨÓý¨Òé
? °´ÆÚ¸üÐÂϵͳ²¹¶¡£¡£¡£¡£¡£¬£¬£¬£¬ïÔÌϵͳÎó²î£¬£¬£¬£¬ÌáÉýЧÀÍÆ÷µÄÇå¾²ÐÔ¡£¡£¡£¡£¡£? ÔöǿϵͳºÍÍøÂçµÄ»á¼û¿ØÖÆ£¬£¬£¬£¬Ð޸ķÀ»ðǽսÂÔ£¬£¬£¬£¬¹Ø±Õ·ÇÐëÒªµÄÓ¦Óö˿ڻòЧÀÍ£¬£¬£¬£¬ïÔ̽«Î£ÏÕЧÀÍ£¨ÈçSSH¡¢RDPµÈ£©Ì»Â¶µ½¹«Íø£¬£¬£¬£¬ïÔ̹¥»÷Ãæ¡£¡£¡£¡£¡£? ʹÓÃÆóÒµ¼¶Çå¾²²úÆ·£¬£¬£¬£¬ÌáÉýÆóÒµµÄÍøÂçÇå¾²ÐÔÄÜ¡£¡£¡£¡£¡£? ÔöǿϵͳÓû§ºÍȨÏÞÖÎÀí£¬£¬£¬£¬ÆôÓöàÒòËØÈÏÖ¤»úÖƺÍ×îСȨÏÞÔÔò£¬£¬£¬£¬Óû§ºÍÈí¼þȨÏÞÓ¦¼á³ÖÔÚ×îµÍÏ޶ȡ£¡£¡£¡£¡£? ÆôÓÃÇ¿ÃÜÂëÕ½ÂÔ²¢ÉèÖÃΪ°´ÆÚÐ޸ġ£¡£¡£¡£¡£
3.4 ²Î¿¼Á´½Ó
https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7-hotfix-1_release_notes.htm/https://www.solarwinds.com/trust-center/security-advisories/cve-2025-26399https://nvd.nist.gov/vuln/detail/CVE-2025-26399
¾©¹«Íø°²±¸11010802024551ºÅ