SolarWinds Log And Event Manager vulnerabilities

5 CVEs affecting SolarWinds Log And Event Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-5199, published 2017-03-24.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-7839, published 2015-10-15. High severity, CVSS 7.5. EPSS: 6.9% chance of exploitation in the next 30 days. SolarWinds Log and Event Manager (LEM) allows remote attackers to execute arbitrary commands on managed computers via a request to services/messagebroker/nonsecurestreamingamf involving the…
CVE-2014-5504, published 2014-09-04. High severity, CVSS 7.5. EPSS: 5.4% chance of exploitation in the next 30 days. SolarWinds Log and Event Manager before 6.0 uses "static" credentials, which makes it easier for remote attackers to obtain access to the database and execute arbitrary code via unspecified vectors,…
CVE-2015-7840, published 2015-10-15. High severity, CVSS 7.5. EPSS: 4.2% chance of exploitation in the next 30 days. The command line management console (CMC) in SolarWinds Log and Event Manager (LEM) before 6.2.0 allows remote attackers to execute arbitrary code via unspecified vectors involving the ping feature.
CVE-2017-5199, published 2017-03-24. High severity, CVSS 8.8. EPSS: 2.9% chance of exploitation in the next 30 days. The editbanner feature in SolarWinds LEM (aka SIEM) through 6.3.1 allows remote authenticated users to execute arbitrary code by editing /usr/local/contego/scripts/mgrconfig.pl.
CVE-2017-5198, published 2017-03-24. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. SolarWinds LEM (aka SIEM) before 6.3.1 has an incorrect sudo configuration, which allows local users to obtain root access by editing /usr/local/contego/scripts/hostname.sh.