CVE-2020-10148
SolarWinds Orion Authentication Bypass Vulnerability
Description
CVE-2020-10148 is a critical-severity authentication bypass vulnerability in the SolarWinds Orion Platform API. The vulnerability allows remote, unauthenticated attackers to bypass API authentication mechanisms and execute arbitrary API commands, potentially leading to full compromise of the SolarWinds Orion instance. This vulnerability was disclosed in the context of the broader SolarWinds supply chain attack campaign that affected numerous government agencies and enterprises. CISA has confirmed active exploitation by adding CVE-2020-10148 to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 94.33% (99.95th percentile), exploitation is near-certain for any exposed instance.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| solarwinds | orion platform | 2019.4; 2020.2; 2020.2.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://kb.cert.org/vuls/id/843464(Third Party Advisory, US Government Resource)
- https://www.solarwinds.com/securityadvisory(Vendor Advisory)
- https://www.kb.cert.org/vuls/id/843464(Third Party Advisory, US Government Resource)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-10148(US Government Resource)
Weakness Type
CWE-288: Authentication Bypass Using an Alternate Path or Channel
Authentication bypass using an alternate path occurs when a system requires authentication but provides an alternative path or channel that circumvents these controls. In CVE-2020-10148, the SolarWinds Orion API contains an alternate path that allows attackers to bypass the authentication mechanism entirely, executing API commands without valid credentials.
Learn more: CWE-288 — Authentication Bypass Using an Alternate Path or Channel
CWE-306: Missing Authentication for Critical Function
Missing authentication for critical function occurs when software does not perform any authentication for functionality that requires a provable user identity. The SolarWinds Orion API exposes critical management functions that can be accessed without authentication due to this vulnerability, enabling unauthorized command execution.
Learn more: CWE-306 — Missing Authentication for Critical Function
Impact Analysis
CVE-2020-10148 carries a CVSS 3.1 score of 9.8 (CRITICAL), indicating maximum severity. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication, and needs no user interaction, making it trivially exploitable by any attacker with network access to the Orion API. Confidentiality (High): Attackers can access all data managed by the SolarWinds Orion instance, including network infrastructure details, monitoring configurations, and credentials. Integrity (High): Unauthorized API command execution allows attackers to modify configurations, deploy malicious updates, and manipulate monitoring data. Availability (High): Attackers can disrupt monitoring services and infrastructure management operations. The EPSS score of 94.33% (99.95th percentile) places this among the most actively exploited vulnerabilities known, and the connection to the SolarWinds supply chain attack campaign underscores the severe consequences of this vulnerability.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2020-10148 through its listing in the Known Exploited Vulnerabilities catalog, and detailed information is available through the CERT/CC advisory VU#843464. The EPSS score of 94.33% (99.95th percentile) indicates near-certain exploitation activity, placing it among the top 0.05% of all vulnerabilities by exploitation likelihood. This vulnerability was exploited as part of the broader SolarWinds Orion supply chain compromise that affected major government agencies and enterprises in 2020, making it one of the most significant cybersecurity incidents in recent history. Federal agencies were required to remediate by 2022-05-03 under CISA directive.
Remediation
- Apply updates per vendor instructions immediately as required by CISA KEV. Install the latest SolarWinds Orion Platform hotfixes from the SolarWinds Security Advisory page.
- Upgrade affected SolarWinds Orion Platform instances: versions 2019.4 HF 5, 2020.2 (no hotfix), and 2020.2 HF 1 are confirmed vulnerable. Apply the latest available hotfix for your version branch or upgrade to a fully patched release.
- Restrict network access to the SolarWinds Orion API endpoints using firewall rules and network segmentation. Only allow access from trusted management networks and disable any internet-facing exposure of the Orion management interface.
- Review all API activity logs and authentication records for evidence of unauthorized access or unusual command execution. Conduct a thorough investigation to determine if the Orion instance was compromised, including checking for unauthorized configuration changes and suspicious account creation.
- Implement network monitoring for anomalous traffic to and from the SolarWinds Orion server, and apply defense-in-depth measures including multi-factor authentication for all administrative access to the Orion platform.
Technical Details
CVE-2020-10148 is an authentication bypass vulnerability in the SolarWinds Orion Platform API affecting versions 2019.4 HF 5, 2020.2 with no hotfix installed, and 2020.2 HF 1. The vulnerability stems from a combination of CWE-288 (authentication bypass via alternate path) and CWE-306 (missing authentication for critical function), meaning the API both provides alternative paths that circumvent authentication and fails to enforce authentication on critical management functions. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates the attack requires only network access with no complexity, privileges, or user interaction, resulting in complete compromise of confidentiality, integrity, and availability. A remote attacker can craft HTTP requests to bypass the authentication mechanism and execute API commands with full privileges on the SolarWinds Orion instance, potentially enabling lateral movement across the monitored network infrastructure.
Frequently Asked Questions
Is CVE-2020-10148 being actively exploited?
Yes. CVE-2020-10148 is confirmed as actively exploited and listed in the CISA Known Exploited Vulnerabilities catalog. It was exploited as part of the high-profile SolarWinds supply chain attack campaign. The EPSS score of 94.33% (99.95th percentile) indicates near-certain exploitation activity.
What products are affected by CVE-2020-10148?
CVE-2020-10148 affects the SolarWinds Orion Platform. Specifically confirmed vulnerable versions are 2019.4 HF 5, 2020.2 (with no hotfix installed), and 2020.2 HF 1. Organizations should consult the SolarWinds security advisory for a complete list of affected versions.
How do I fix CVE-2020-10148?
Apply the latest hotfixes from SolarWinds immediately. Upgrade affected Orion Platform instances to fully patched versions. Restrict API access to trusted networks only and implement multi-factor authentication for administrative access.
How severe is CVE-2020-10148?
CVE-2020-10148 has a CVSS 3.1 score of 9.8 (CRITICAL), indicating maximum severity. The vulnerability allows unauthenticated remote attackers to execute arbitrary API commands on SolarWinds Orion instances. Its 99.95th percentile EPSS ranking and connection to the SolarWinds supply chain attack make it one of the most critical vulnerabilities to address.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.