Vulnerability Intelligence Report
Insecure Deserialization of untrusted data causing Remote code execution vulnerability.
CVE-2021-35217
Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module and reported to us by ZDI. An Authenticated Attacker could exploit it by executing WSAsyncExecuteTasks deserialization of untrusted data.
No Active Exploit Signals
CVSS Base Score
8.9
HIGH
Exploitability:2.3
Impact Score:6.0
EPSS Probability:73.85%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| SolarWinds | Orion Platform | 2020.2.5 and previous versions < 2020.2.6 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
73.854%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | SolarWinds · Vendor · USA |
| Reserved | 2021-06-22T00:00:00 |
| Published | 2021-09-08T13:15:03 |
| Patch Date | 2021-09-02 |
| Last Updated | 2024-09-16T20:58:13 |
Community Chatter & Buzz