✕

Rewterz Annual Threat Intelligence Report 2025 - Download Now

Request a Demo
Rewterz

Rewterz Threat Alert – APT32 Ocean Lotus – Active IOCs

January 21, 2022
Rewterz

Rewterz Threat Alert – Cobalt Strike Malware – Active IOCs

January 21, 2022

Rewterz Threat Advisory – SolarWinds Serv-U Vulnerability Exploited in the Wild

Severity

Medium

Analysis Summary

CVE-2021-35247

SolarWinds Serv-U allows a remote attacker to execute arbitrary codes on an infected system. This is caused by an improper input validation error by the web login screen. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary codes on the system.

“During our sustained monitoring of threats taking advantage of the Log4j 2 vulnerabilities, we observed activity related to attacks being propagated via a previously undisclosed vulnerability in the SolarWinds Serv-U software. ” reads the advisory published by Microsoft.

According to the analysis posted by SolarWinds, Serv-U software allowed insufficiently sanitized characters through the LDAP authentication servers. The latest released version 15.3 addresses this vulnerability by performing sanitization and additional validation. 

Impact

  • Gain Access
  • Code Execution

Affected Vendors

SolarWinds

Affected Products

  • Serv-U 15.2.5 and previous versions

Remediation

Visit the following advisories released by Microsoft and SolarWinds to learn more about the vulnerability:

Guidance for preventing, detecting, and hunting for exploitation of the Log4j 2 vulnerability

For patches, upgrades, and to download the latest version of Serv-U, visit:

https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35247

Reading this advisory was a good start.

Make it a habit.

Rewterz publishes threat advisories ahead of mainstream cybersecurity media, informed by an AI-Native Autonomous SOC that sees regional threat actor activity in real time. Subscribe to receive each new advisory as it publishes, plus a monthly Middle East threat landscape brief drawn from our own SOC telemetry. For teams evaluating their detection coverage, a 30-minute consultation with a senior analyst is also available, at your pace, when you're ready.

Request a demo