CVE-2024-28987
SolarWinds Web Help Desk Hardcoded Credential Vulnerability
Description
CVE-2024-28987 is a critical hardcoded credential vulnerability in SolarWinds Web Help Desk (WHD) that allows a remote, unauthenticated attacker to access internal functionality and modify data using embedded credentials. The flaw affects SolarWinds Web Help Desk versions prior to and including 12.8.3 without the required hotfix. With a CVSS v3.1 base score of 9.1 (CRITICAL) and no authentication or user interaction required, this vulnerability provides trivial access to the help desk platform's backend. CISA added CVE-2024-28987 to the Known Exploited Vulnerabilities catalog with a remediation deadline of November 5, 2024, and its EPSS score of 94.17% at the 99.9th percentile indicates near-universal exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| solarwinds | web help desk | < 12.8.3; 12.8.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References
- https://support.solarwinds.com/SuccessCenter/s/article/SolarWinds-Web-Help-Desk-12-8-3-Hotfix-2(Release Notes)
- https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28987(Vendor Advisory)
- https://www.theregister.com/2024/08/22/hardcoded_credentials_bug_solarwinds_whd/(Press/Media Coverage, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-28987(US Government Resource)
Weakness Type
CWE-798: Use of Hard-coded Credentials
CVE-2024-28987 exploits a hard-coded credential weakness where the SolarWinds Web Help Desk application contains embedded username and password combinations that cannot be changed by administrators and are identical across all installations. These hardcoded credentials provide direct access to internal application functionality, bypassing the normal authentication process entirely. This class of vulnerability is particularly dangerous because patching requires a software update rather than a simple password change, and all unpatched instances share the same credentials.
Learn more: CWE-798 — Use of Hard-coded Credentials
Impact Analysis
The impact of CVE-2024-28987 is severe, with Confidentiality (High) and Integrity (High) fully compromised, though Availability remains unaffected (A:N). The attack is network-accessible (AV:N) with low complexity (AC:L), requires no privileges (PR:N) and no user interaction (UI:N), making exploitation trivially simple for any attacker who discovers the hardcoded credentials. SolarWinds Web Help Desk is an IT service management platform that stores sensitive information including employee details, IT asset inventories, support ticket contents with potentially confidential data, internal knowledge base articles, and configuration details for connected systems. Attackers leveraging the hardcoded credentials can read all stored data and modify records, potentially escalating access by manipulating user accounts or modifying help desk workflows. The EPSS score of 94.17% at the 99.9th percentile places this among the most exploited vulnerabilities tracked, reflecting the ease of exploitation and the value of the data accessible through compromised help desk systems. While the ransomware nexus is listed as Unknown, the access to sensitive internal data makes this an attractive intelligence-gathering vector for advanced threat actors.
Exploit Maturity
CVE-2024-28987 has maximum exploit maturity given the trivial nature of hardcoded credential exploitation. CISA confirmed active exploitation by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of November 5, 2024. The EPSS score of 94.17% at the 99.9th percentile represents near-universal exploitation, making it one of the most targeted vulnerabilities of 2024. SolarWinds published the remediation in Web Help Desk 12.8.3 Hotfix 2 and a corresponding security advisory. The hardcoded credentials were publicly disclosed and documented by The Register, enabling mass exploitation by any attacker. The simplicity of the exploit, which requires only knowledge of the embedded credentials and network access to the WHD instance, makes automated scanning and exploitation extremely straightforward.
Remediation
-
Apply SolarWinds Web Help Desk 12.8.3 Hotfix 2 immediately as documented in the SolarWinds support article. This hotfix removes the hardcoded credentials from the application. Note that you must first upgrade to version 12.8.3 before applying the hotfix.
-
Restrict network access to the Web Help Desk instance by ensuring it is not directly accessible from the internet. Place WHD behind a VPN or reverse proxy with authentication, and limit access to authorized internal networks only.
-
Audit Web Help Desk access logs and data integrity for signs of unauthorized access using the hardcoded credentials. Review login records, data modification timestamps, user account changes, and any exported data. Check for unauthorized creation or modification of admin accounts.
-
Rotate credentials for all integrated systems that Web Help Desk connects to, including LDAP/Active Directory service accounts, email server credentials, database connections, and any API keys stored in the WHD configuration, as these may have been exposed through the hardcoded access.
-
Implement network monitoring for WHD traffic to detect any ongoing exploitation attempts. Set up alerts for authentication attempts using the known hardcoded credentials and monitor for unusual data access patterns or bulk data exports from the help desk platform.
Technical Details
CVE-2024-28987 is a hardcoded credential vulnerability in SolarWinds Web Help Desk. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N reflects a network-accessible (AV:N), low-complexity (AC:L) attack requiring no privileges (PR:N) and no user interaction (UI:N), with Unchanged scope (S:U), high impact on confidentiality and integrity, but no availability impact. The Availability rating of None (A:N) indicates the hardcoded credentials provide data access and modification capabilities but not the ability to disrupt service operation. The vulnerability exists because the WHD application contains hardcoded username and password credentials embedded directly in the application code or configuration files. These credentials are identical across all WHD installations worldwide, meaning that once discovered, they provide access to every unpatched instance. The hardcoded credentials grant access to internal application APIs and functionality that should require proper authentication, enabling attackers to read sensitive help desk data including ticket contents, user information, and asset details, as well as modify records and potentially escalate privileges within the application. The technical simplicity of exploitation, requiring only an HTTP request with the known credentials, combined with the widespread deployment of WHD in enterprise IT environments, makes this a high-value target for both opportunistic and targeted attacks.
Frequently Asked Questions
Is CVE-2024-28987 being actively exploited?
Yes, CISA confirmed active exploitation by adding CVE-2024-28987 to the Known Exploited Vulnerabilities catalog. With an EPSS score of 94.17% at the 99.9th percentile, it is among the most exploited vulnerabilities of 2024 due to the trivial nature of hardcoded credential abuse.
What products are affected by CVE-2024-28987?
SolarWinds Web Help Desk versions up to and including 12.8.3 without Hotfix 2 are affected. All installations share the same hardcoded credentials, making every unpatched instance equally vulnerable.
How do I fix CVE-2024-28987?
Upgrade to SolarWinds Web Help Desk 12.8.3 and apply Hotfix 2, which removes the hardcoded credentials. Restrict network access to the WHD instance, audit for unauthorized access, and rotate all credentials for integrated systems.
Why are hardcoded credentials particularly dangerous?
Hardcoded credentials cannot be changed by administrators through normal configuration. They are identical across every installation, meaning once discovered, every unpatched instance worldwide is equally vulnerable. Unlike other vulnerabilities that require exploit development, hardcoded credentials provide instant, reliable access with minimal technical skill.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.