Vulnerability record · CVE-2024-28987 · published 21 August 2024
CVE-2024-28987: SolarWinds Web Help Desk hardcoded credential flaw
Solarwinds · Web Help Desk
SolarWinds Web Help Desk contains a hardcoded credential vulnerability (CWE-798) that lets a remote, unauthenticated attacker reach internal functionality and modify data. The flaw is rated CVSS 9.1 critical and is listed in CISA's Known Exploited Vulnerabilities catalog, so it is being actively targeted in the wild.
Description
The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Automated analysis
critical priorityCVSS 9.1 with unauthenticated remote access, active KEV listing, and a 0.932 EPSS probability make this an urgent patch-first issue.
What it is
SolarWinds Web Help Desk contains a hardcoded credential vulnerability (CWE-798) that lets a remote, unauthenticated attacker reach internal functionality and modify data. The flaw is rated CVSS 9.1 critical and is listed in CISA's Known Exploited Vulnerabilities catalog, so it is being actively targeted in the wild.
Impact
An attacker gains unauthenticated access to internal Web Help Desk functions and can modify data, with high confidentiality and integrity impact but no direct availability impact per the CVSS vector.
Attack surface
Reachable over the network with no authentication and no user interaction required (AV:N/AC:L/PR:N/UI:N). Any internet- or network-exposed Web Help Desk instance is a candidate target.
Exploitation
CISA added this to the KEV catalog on 2024-10-15 with a remediation due date of 2024-11-05, and EPSS shows a 30-day probability of 0.932 (99.8th percentile), indicating active exploitation is expected. No ransomware campaign use is documented in the record.
What to do
- Apply the SolarWinds Web Help Desk 12.8.3 Hotfix 2 release per the vendor advisory, or discontinue use if mitigations are unavailable.
- Restrict network access to Web Help Desk instances so they are not exposed to untrusted networks.
- Rotate any credentials or secrets associated with Web Help Desk and review accounts for unauthorized changes.
- Monitor vendor advisory and CISA KEV guidance for updated mitigation instructions.
Detection
- Review Web Help Desk logs for unauthenticated or anomalous access to internal functionality and unexpected data modifications.
- Hunt for authentication events using default or hardcoded credentials against Web Help Desk endpoints.
- Alert on outbound or lateral connections from Web Help Desk hosts that are inconsistent with normal behavior.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2024-28987 to the Known Exploited Vulnerabilities catalog on 15 October 2024 as "SolarWinds Web Help Desk Hardcoded Credential Vulnerability". Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 5 November 2024.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://support.solarwinds.com/SuccessCenter/s/article/SolarWinds-Web-Help-Desk-12-8-3-Hotfix-2 | Release Notes |
| https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28987 | Vendor Advisory |
| https://www.theregister.com/2024/08/22/hardcoded_credentials_bug_solarwinds_whd/ | Press/Media CoverageThird Party Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-28987 | US Government Resource |
Track CVE-2024-28987 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2024-28987), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
