SolarWinds fixes second critical flaw in Web Help Desk in a week
Take action: Another critical flaw in Web Help Desk - this one is with hardcoded credentials. Review the patch instructions and test the patch. If your WHD is not exposed on the internet, you can wait for the full patch. Otherwise, follow the instructions and apply the hotfix, or you will be hacked - hackers love SolarWinds products. After the release of the PoC, it's time to patch urgently, because hackers now have all the details to attack you.
Learn More
SolarWinds has released a hotfix for another critical vulnerability in its Web Help Desk (WHD) software. Web Help Desk is widely deployed by government agencies, large corporations, healthcare institutions, and educational organizations to manage IT help desk operations.
The second critical flaw in a week is tracked as CVE-2024-28987 (CVSS score 9.1) allows attackers to log into unpatched systems using hardcoded credentials, granting unauthorized access to internal functionality and enabling data modification on compromised devices.
The vulnerability affects versions prior to Web Help Desk 12.8.3.1813 or 12.8.3 HF1. Users are strongly advised to update to Web Help Desk 12.8.3 Hotfix 2, which patches this issue.
In addition to CVE-2024-28987, this hotfix carries the patch for the previously reported critical remote code execution (RCE) vulnerability, CVE-2024-28986, which was fixed on August 14 and reported by CISA as being actively exploited.
