Skip to content
OpenAdvisories
High WID-SEC-2025-2618 3 CVEs

SolarWinds Serv-U: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode mit Administratorrechten

Published Nov 17, 2025 · Updated Nov 18, 2025 · Revision 2 · de-DE

Vendor: SolarWinds Product: Serv-U Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in SolarWinds Serv-U ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen.

Product

SolarWinds Serv-U ist eine FTP-Server Software.

Vulnerabilities 3

  • Critical 9.1
    CVE-2025-40547

    SolarWinds Serv-U Logic Abuse - Remote Code Execution Vulnerability

    A logic error vulnerability exists in Serv-U which when abused could give a malicious actor with access to admin privileges the ability to execute code. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a me…

    SolarWinds Serv-U
  • Critical 9.1
    CVE-2025-40548

    SolarWinds Serv-U Broken Access Control - Remote Code Execution Vulnerability

    A missing validation process exists in Serv U when abused, could give a malicious actor with access to admin privileges the ability to execute code. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium…

    SolarWinds Serv-U
  • Critical 9.1
    CVE-2025-40549

    SolarWinds Serv-U Path Restriction Bypass Vulnerability

    A Path Restriction Bypass vulnerability exists in Serv-U that when abused, could give a malicious actor with access to admin privileges the ability to execute code on a directory. This issue requires administrative privileges to abuse. On Windows systems, thi…

    SolarWinds Serv-U

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2025-197930

  2. #1

    Initiale Fassung

References