CVE-2020-25618

Name of the Vulnerable Software and Affected Versions SolarWinds N-Central version 12.3.0.670

Description An issue was discovered in the sudo configuration of SolarWinds N-Central, which has incorrect access control. The nable web user account is effectively able to run arbitrary OS commands as root because the use of root privileges is not limited to specific programs listed in the sudoers file.

Recommendations For SolarWinds N-Central version 12.3.0.670, consider restricting the privileges of the nable web user account to prevent it from running arbitrary OS commands as root until a patch is available. As a temporary workaround, review and modify the sudoers file to limit the use of root privileges to specific programs.