CVE‑2024‑28987: SolarWinds Web Help Desk Hard‑coded Credential Vulnerability – Remote Unauthorized Data Modification
What It Is — SolarWinds Web Help Desk ships with a hard‑coded credential that grants unauthenticated remote access to internal APIs. An attacker can use this credential to read or modify ticket data without legitimate login.
Exploitability — The flaw is publicly disclosed in CISA’s Known Exploited Vulnerabilities list, indicating active exploitation in the wild. No public proof‑of‑concept is required; the credential is static and can be used directly. CVSS (v3.1) is rated 8.8 (High).
Affected Products — SolarWinds Web Help Desk (all supported versions as of the advisory date).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous credential hygiene and automated discovery of hard‑coded secrets as part of an ongoing control‑monitoring program.
- A breach of ticketing data undermines audit trails and can invalidate evidence of service‑level compliance during third‑party assessments.
- Enterprises that must prove defensible access‑control practices (e.g., under NIST CSF or ISO 27001) will be asked to show that privileged credentials are regularly rotated and that privileged‑access logging is enforced.
Recommended Actions
- Immediately rotate any default or hard‑coded credentials in SolarWinds Web Help Desk and enforce unique, strong passwords.
- Deploy secret‑scanning tools to detect hard‑coded secrets in deployed binaries and configuration files.
- Enable multi‑factor authentication (MFA) for all privileged accounts and enforce least‑privilege access policies.
- Verify that audit logging for credential use and ticket modifications is enabled and that logs are retained per your compliance schedule.
- Review vendor‑provided patches or mitigation guidance and apply them without delay.
Source: CISA KEV – CVE‑2024‑28987