Lucene search

TenableCVE-2019-3980

HistoryOct 08, 2019 - 8:15 p.m.

CVE-2019-3980

2019-10-0820:15:12

CWE-346

tenable

web.nvd.nist.gov

109

cve-2019-3980

solarwinds

dameware

mini remote client

smart card authentication

remote code execution

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.8

Confidence

High

EPSS

0.013

Percentile

86.0%

JSON

The Solarwinds Dameware Mini Remote Client agent v12.1.0.89 supports smart card authentication which can allow a user to upload an executable to be executed on the DWRCS.exe host. An unauthenticated, remote attacker can request smart card login and upload and execute an arbitrary executable run under the Local System account.

Affected configurations

Nvd

Node

solarwindsdameware_mini_remote_controlMatch12.1.0.89

VendorProductVersionCPE
solarwindsdameware_mini_remote_control12.1.0.89cpe:2.3:a:solarwinds:dameware_mini_remote_control:12.1.0.89:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
solarwinds	dameware_mini_remote_control	12.1.0.89	cpe:2.3:a:solarwinds:dameware_mini_remote_control:12.1.0.89:::::::*

CNA Affected

[
  {
    "product": "SolarWinds Dameware Remote Mini Remote Client Agent Service",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Versions up to and including 12.1.0.89"
      }
    ]
  }
]

References

www.tenable.com/security/research/tra-2019-43

www.tenable.com/security/research/tra-227-43

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.8

Confidence

High

EPSS

0.013

Percentile

86.0%

JSON

Related for CVE-2019-3980