CVE Feed

    Dashboard / CVE / CVE-2020-25619

    CVE-2020-25619

    An issue was discovered in SolarWinds N-Central 12.3.0.670. The SSH component does not restrict the Communication Channel to Intended Endpoints. An attacker can leverage an SSH feature (port forwarding with a temporary key pair) to access network services on the 127.0.0.1 interface, even though this feature was only intended for user-to-agent communication.

    Published:Dec 16, 2020
    Last Modified:Nov 21, 2024
    EPS:Dec 16, 2020
    EPSS Score:0.00799
    CVSS Score:4.4

    Affected Products

    Vendor
    Solarwinds
    Product
    N-central

    Exploits

    No exploit reference

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2020-25622 (CVSS 8.8) — An issue was discovered in SolarWinds N-Central 12.3.0.670. The AdvancedScripts HTTP endpoint allows CSRF.…
    CVE-2020-25621 (CVSS 8.4) — An issue was discovered in SolarWinds N-Central 12.3.0.670. The local database does not require authentication…
    CVE-2020-25620 (CVSS 7.8) — An issue was discovered in SolarWinds N-Central 12.3.0.670. Hard-coded Credentials exist by default for local …
    CVE-2020-25618 (CVSS 8.8) — An issue was discovered in SolarWinds N-Central 12.3.0.670. The sudo configuration has incorrect access contro…
    CVE-2020-25617 (CVSS 8.8) — An issue was discovered in SolarWinds N-Central 12.3.0.670. The AdvancedScripts HTTP endpoint allows Relative …
    CVE-2020-15910 (CVSS 4.7) — SolarWinds N-Central version 12.3 GA and lower does not set the JSESSIONID attribute to HTTPOnly. This makes i…
    CVE-2020-15909 (CVSS 8.8) — SolarWinds N-central through 2020.1 allows session hijacking and requires user interaction or physical access.…
    CVE-2020-7984 (CVSS 7.5) — SolarWinds N-central before 12.1 SP1 HF5 and 12.2 before SP1 HF2 allows remote attackers to retrieve cleartext…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High