Critical severity · published Oct 8, 2019
CVE-2019-3980
The Solarwinds Dameware Mini Remote Client agent v12.1.0.89 supports smart card authentication which can allow a user to upload an executable to be executed on the DWRCS.exe host
9.8
CVSS
5.2%
EPSS
No
On KEV
Description
The Solarwinds Dameware Mini Remote Client agent v12.1.0.89 supports smart card authentication which can allow a user to upload an executable to be executed on the DWRCS.exe host. An unauthenticated, remote attacker can request smart card login and upload and execute an arbitrary executable run under the Local System account.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)5.2% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DM
Dameware Mini Remote Control · Solarwinds
12.1.0.89 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-3980
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-3980
Third Party Advisory
https://www.tenable.com/security/research/tra-2019-43
Exploit
https://www.tenable.com/security/research/tra-227-43
More from Dameware Mini Remote Control
9.1
CVE-2021-31217
In SolarWinds DameWare Mini Remote Control Server 12.0.1.200, insecure file permissions allow file deletion as SYSTEM
7.8
CVE-2018-12897
SolarWinds DameWare Mini Remote Control before 12.1 has a Buffer Overflow
7.5
CVE-2019-9017
DWRCC in SolarWinds DameWare Mini Remote Control 10.0 x64 has a Buffer Overflow associated with the size field for the machine name
7.4
CVE-2019-3957
Dameware Remote Mini Control version 12.1.0.34 and prior contains an unauthenticated remote buffer over-read due to the server not properly validating RsaSignatureLen during key…
–
CVE-2015-8220
Stack-based buffer overflow in the URI handler in DWRCC.exe in SolarWinds DameWare Mini Remote Control before 12.0 HotFix 1 allows remote attackers to execute arbitrary code via a…