SolarWinds Dameware Mini Remote Control vulnerabilities

7 CVEs affecting SolarWinds Dameware Mini Remote Control, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-31217, published 2021-07-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-3957, published 2019-06-07. High severity, CVSS 7.4. EPSS: 25.6% chance of exploitation in the next 30 days. Dameware Remote Mini Control version 12.1.0.34 and prior contains an unauthenticated remote buffer over-read due to the server not properly validating RsaSignatureLen during key negotiation, which…
CVE-2019-9017, published 2019-05-02. High severity, CVSS 7.5. EPSS: 19.2% chance of exploitation in the next 30 days. DWRCC in SolarWinds DameWare Mini Remote Control 10.0 x64 has a Buffer Overflow associated with the size field for the machine name.
CVE-2019-3980, published 2019-10-08. Critical severity, CVSS 9.8. EPSS: 5.1% chance of exploitation in the next 30 days. The Solarwinds Dameware Mini Remote Client agent v12.1.0.89 supports smart card authentication which can allow a user to upload an executable to be executed on the DWRCS.exe host. An unauthenticated,…
CVE-2015-8220, published 2015-11-17. High severity, CVSS 7.5. EPSS: 4.8% chance of exploitation in the next 30 days. Stack-based buffer overflow in the URI handler in DWRCC.exe in SolarWinds DameWare Mini Remote Control before 12.0 HotFix 1 allows remote attackers to execute arbitrary code via a crafted commandline…
CVE-2021-31217, published 2021-07-13. Critical severity, CVSS 9.1. EPSS: 4% chance of exploitation in the next 30 days. In SolarWinds DameWare Mini Remote Control Server 12.0.1.200, insecure file permissions allow file deletion as SYSTEM.
CVE-2018-12897, published 2018-09-07. High severity, CVSS 7.8. EPSS: 1.7% chance of exploitation in the next 30 days. SolarWinds DameWare Mini Remote Control before 12.1 has a Buffer Overflow.
CVE-2004-1852, published 2004-03-23. Medium severity, CVSS 5.0. EPSS: 0.8% chance of exploitation in the next 30 days. DameWare Mini Remote Control 3.x before 3.74 and 4.x before 4.2 transmits the Blowfish encryption key in plaintext, which allows remote attackers to gain sensitive information.