CVE-2024-0692

What it actually does

CVE-2024-0692 is an unauthenticated remote code execution vulnerability in SolarWinds Security Event Manager associated with unsafe handling of serialized data or service requests. An attacker with network adjacency to the vulnerable service can send crafted input that is processed by the SolarWinds SEM service and causes attacker-controlled code to execute in the context of the affected service. Because the CVSS impact values are high for confidentiality, integrity, and availability, successful exploitation can allow full compromise of the SEM application layer, access to collected security event data, alteration or deletion of logs, deployment of additional tooling, and disruption of monitoring functions.

Why it matters to the business

A compromised Security Event Manager can undermine an organization’s ability to detect and investigate attacks because the platform stores and processes security logs. Exploitation could let an attacker view sensitive event data, tamper with evidence, disable or degrade monitoring, or use the SEM appliance as a foothold for further internal movement. Although it is not listed in CISA KEV and is not currently marked as ransomware-associated, the EPSS score is very high and exploit maturity is listed as weaponized, so internet- or broadly reachable deployments should be treated as urgent remediation priorities.

How an attack unfolds

An attacker first identifies a reachable SolarWinds Security Event Manager service from a network segment that can communicate with it. Because the flaw does not require authentication or user interaction, the attacker does not need valid credentials. The attacker then sends a crafted request or serialized payload to the vulnerable SolarWinds service. The service processes the malicious input incorrectly, triggering deserialization-related code execution. If successful, the attacker gains execution under the permissions of the affected SEM service or appliance process. From there, the attacker may establish persistence, enumerate stored logs and configuration, modify or delete security event records, stage additional payloads, pivot to systems that trust or communicate with SEM, or disable monitoring to conceal later activity.

How to fix it

Upgrade SolarWinds Security Event Manager to a vendor-supported version that contains the fix for CVE-2024-0692. If exact fixed versions are not available in the asset inventory, verify the installed version against the current SolarWinds advisory and install the latest SEM security update or hotfix. Until patching is complete, restrict access to SEM management and service interfaces to trusted administrative networks only, block untrusted network paths, enforce firewall allowlists, and ensure SEM is not exposed to the public internet. Place SEM behind segmentation controls, limit inbound access to required log-source and administrator systems, and monitor for unexpected outbound connections from the SEM appliance. After remediation, rotate credentials, API tokens, integration secrets, and certificates that may have been accessible to the SEM system if compromise is suspected.

How to confirm the fix worked

Confirm the deployed SolarWinds Security Event Manager version is at or above the vendor-fixed release identified in the SolarWinds advisory for CVE-2024-0692. Validate that no vulnerable SEM interfaces are reachable from untrusted networks by performing authenticated asset review and network scanning from representative internal segments. Confirm firewall rules only permit required log ingestion and administrative access paths. Review SEM service health after patching and ensure normal log collection, alerting, and forwarding continue to operate. If exploitation is suspected, validate integrity by comparing appliance configuration, service binaries, scheduled jobs, startup scripts, and log retention settings against known-good baselines or a freshly patched reference system.

Typical attack path

1. Identify SolarWinds Security Event Manager instances reachable from the attacker’s network position.
2. Confirm that the exposed service is a vulnerable SEM version or behaves like the vulnerable service.
3. Send a crafted unauthenticated request or serialized payload to the affected SEM service.
4. Achieve code execution in the context of the SolarWinds SEM service or appliance process.
5. Run discovery commands to understand privileges, network reachability, stored logs, and integrations.
6. Deploy a web shell, reverse shell, scheduled task, cron job, or other persistence mechanism if the platform permits it.
7. Access, alter, or delete security event data to support further intrusion activity or evade detection.
8. Use the compromised SEM system as a foothold for lateral movement or to disrupt security monitoring.

How to detect it

To determine whether exploitation already occurred, review SolarWinds SEM appliance and application logs, operating system logs, network flow records, EDR telemetry, firewall logs, DNS logs, and SIEM events covering the SEM host before and after the first possible exposure date. Look for unauthenticated requests to SEM services followed by service crashes, restarts, abnormal error messages, unexpected child processes, shell execution, file writes in temporary or web-accessible locations, new scheduled tasks or cron entries, new local users, changes to log retention or alerting configuration, and outbound connections from the SEM system to unfamiliar destinations. Because this vulnerability affects a security monitoring platform, also look for evidence of log tampering: gaps in event ingestion, unexpected purges, disabled connectors, deleted correlation rules, altered alert actions, or abrupt changes in event volume. Network teams should inspect flows for unusual inbound connections to SEM from non-administrative segments and unusual outbound connections from SEM to workstations, domain infrastructure, file shares, or external IP addresses. If EDR is present on the appliance or supporting host, hunt for command interpreters, scripting engines, archive utilities, download utilities, or network tunneling tools spawned by SolarWinds SEM-related processes. No public, unique exploit string is reliably derivable from the provided vulnerability details, so detection should prioritize behavioral evidence and baseline deviations rather than a single signature.

What your security team should do

• Treat this as high priority because exploit maturity is weaponized and EPSS is very high, even though the CVE is not currently listed in CISA KEV.
• Immediately identify all SolarWinds Security Event Manager deployments, including appliances, test instances, disaster recovery systems, and segmented monitoring networks.
• Patch or upgrade all affected SEM deployments to the SolarWinds-fixed version or latest supported release.
• Restrict SEM access to trusted networks and block any unnecessary inbound access, especially from user VLANs, partner networks, VPN pools, and the internet.
• Hunt for signs of exploitation before patching, focusing on unexpected process execution, service crashes, configuration changes, outbound connections, and log tampering on SEM systems.
• Review and rotate credentials, tokens, certificates, and integration secrets stored in or accessible to SEM if suspicious activity is found.
• Increase monitoring for anomalous activity from the SEM system, including lateral movement, unusual authentication attempts, DNS lookups, and outbound command-and-control-like traffic.
• Preserve forensic evidence before rebuilding or restoring if compromise is suspected, because SEM may contain evidence of both the exploit and subsequent attacker activity.