Security SolarWinds left critical hardcoded credentials in its Web Help Desk product

[J65nko]

From https://www.theregister.com/2024/08/...olarwinds_whd/:

SolarWinds left hardcoded credentials in its Web Help Desk product that can be used by remote, unauthenticated attackers to log into vulnerable instances, access internal functionality, and modify sensitive data

The software maker has now issued an update to address that critical oversight; its users are encouraged to install the fix, which presumably removes the baked-in creds.

The security blunder, tracked as CVE-2024-28987, received a 9.1-out-of-10 CVSS severity rating. It affects Web Help Desk 12.8.3 HF1 and all previous versions, and has been fixed in 12.8.3 HF2. The hotfix patch, issued yesterday, has to be manually installed.

[jmccue]

Yes this can happen, but you would think the company would have beefed up their QA.

I do nor understand why they are not in Chapter 11 by now.