SolarWinds Network Configuration Manager vulnerabilities

7 CVEs affecting SolarWinds Network Configuration Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-40055, published 2023-11-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-3459, published 2014-08-07. Medium severity, CVSS 6.8. EPSS: 11.6% chance of exploitation in the next 30 days. Heap-based buffer overflow in SolarWinds Network Configuration Manager (NCM) before 7.3 allows remote attackers to execute arbitrary code via the PEstrarg1 property.
CVE-2023-40054, published 2023-11-09. High severity, CVSS 8.8. EPSS: 3% chance of exploitation in the next 30 days. The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows a low-level user to perform the actions with SYSTEM…
CVE-2023-40055, published 2023-11-09. High severity, CVSS 8.8. EPSS: 2.1% chance of exploitation in the next 30 days. The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows a low-level user to perform the actions with SYSTEM…
CVE-2023-33227, published 2023-11-01. High severity, CVSS 8.8. EPSS: 1.8% chance of exploitation in the next 30 days. The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability This vulnerability allows a low level user to perform the actions with SYSTEM…
CVE-2023-33226, published 2023-11-01. High severity, CVSS 8.8. EPSS: 1.8% chance of exploitation in the next 30 days. The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows a low-level user to perform the actions with SYSTEM…
CVE-2021-35226, published 2022-10-10. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. An entity in Network Configuration Manager product is misconfigured and exposing password field to Solarwinds Information Service (SWIS). Exposed credentials are encrypted and require authenticated…
CVE-2023-33228, published 2023-11-01. Medium severity, CVSS 4.9. EPSS: 0.4% chance of exploitation in the next 30 days. The SolarWinds Network Configuration Manager was susceptible to the Exposure of Sensitive Information Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web…