CVE-2021-25276

In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' password hashes) that is world readable and writable. An unprivileged Windows user (having access to the server's filesystem) can add an FTP user by copying a valid profile file to this directory. For example, if this profile sets up a user with a C:\ home directory, then the attacker obtains access to read or replace arbitrary files with LocalSystem privileges.

• CWE-732

• https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/full-system-control-with-new-solarwinds-orion-based-and-serv-u-ftp-vulnerabilities/Exploit, Third Party Advisory
• https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/full-system-control-with-new-solarwinds-orion-based-and-serv-u-ftp-vulnerabilities/Exploit, Third Party Advisory

Published

Feb 3, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-25269A local administrator could prevent the HMPA service from st…4.4
• CVE-2021-25270A local attacker could execute arbitrary code with administr…6.7
• CVE-2021-25271A local attacker could read or write arbitrary files with ad…6
• CVE-2021-25273Stored XSS can execute as administrator in quarantined email…4.8
• CVE-2021-25274The Collector Service in SolarWinds Orion Platform before 20…9.8
• CVE-2021-25275SolarWinds Orion Platform before 2020.2.4, as used by variou…7.8
• CVE-2021-25277FTAPI 4.0 - 4.10 allows XSS via a crafted filename to the al…6.1
• CVE-2021-25278FTAPI 4.0 through 4.10 allows XSS via an SVG document to the…4.8
• CVE-2021-25281An issue was discovered in through SaltStack Salt before 300…9.8
• CVE-2021-25282An issue was discovered in through SaltStack Salt before 300…9.1
• CVE-2021-25283An issue was discovered in through SaltStack Salt before 300…9.8
• CVE-2021-25284An issue was discovered in through SaltStack Salt before 300…4.4