« Volver al listado

CVE-2025-40541

Estado: AnalizadaAlta (7.2)—

An Insecure Direct Object Reference (IDOR) vulnerability exists in Serv-U, which when exploited, gives a malicious actor the ability to execute native code as a privileged account.

This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

IDOR en Serv-U requiere privilegios administrativos (PR:H) para ejecutar código nativo en cuenta privilegiada. AV:N y PR:H indican T1210 (explotación de servicios remotos con autenticación). Logra ejecución de código (T1059) y escalada a privilegios (T1068).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramPrivileged Account ManagementExecution PreventionDisable or Remove Feature or ProgramApplication Isolation and SandboxingExploit Protection

Tecnologías afectadas (1)

Solarwinds — Serv-u

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-40541",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-40541",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-25T04:55:25.783559Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@solarwinds.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.3
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@solarwinds.com",
      "affectedData": [
        {
          "vendor": "SolarWinds",
          "product": "Serv-U",
          "versions": [
            {
              "status": "affected",
              "version": "SolarWinds Serv-U 15.5.3 and prior versions"
            }
          ],
          "platforms": [
            "Windows",
            "Linux"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-02-24T08:16:28.220",
  "references": [
    {
      "url": "https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-4_release_notes.htm",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "psirt@solarwinds.com"
    },
    {
      "url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40541",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@solarwinds.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@solarwinds.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-704"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An Insecure Direct Object Reference (IDOR) vulnerability exists in Serv-U, which when exploited, gives a malicious actor the ability to execute native code as a privileged account.\n\nThis issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default."
    },
    {
      "lang": "es",
      "value": "Hay una vulnerabilidad de tipo Insecure Direct Object Reference (IDOR) en Serv-U que, al ser explotada, otorga a un actor malicioso la capacidad de ejecutar código nativo como una cuenta privilegiada.\n\nPara se explotada, este problema requiere privilegios de administrador. En implementaciones de Windows, el riesgo se califica como medio porque los servicios, con frecuencia, se ejecutan bajo cuentas de servicio menos privilegiadas por defecto."
    }
  ],
  "lastModified": "2026-06-17T09:21:43.960",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:solarwinds:serv-u:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0879DDA2-3F57-41C7-A689-4B904310687E",
              "versionEndExcluding": "15.5.4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@solarwinds.com"
}