VulnerabilityModified

CVE-2015-7840

The command line management console (CMC) in SolarWinds Log and Event Manager (LEM) before 6.2.0 allows remote attackers to execute arbitrary code via unspecified vectors involving the ping feature.

HIGH 7.5EPSS 4.23%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (4.23%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

The command line management console (CMC) in SolarWinds Log and Event Manager (LEM) before 6.2.0 allows remote attackers to execute arbitrary code via unspecified vectors involving the ping feature.

CVSS 2.0: 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS: 4.23% probability · 90th percentile
CISA KEV: Not listed
Weakness: CWE-264
Affected: solarwinds/log and event manager
Source: cve@mitre.org

References

http://www.solarwinds.com/documentation/lem/docs/releasenotes/releasenotes.htmVendor Advisory
https://security.gentoo.org/glsa/201603-11
http://www.solarwinds.com/documentation/lem/docs/releasenotes/releasenotes.htmVendor Advisory
https://security.gentoo.org/glsa/201603-11

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.