IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Microsoft warns SolarWinds customers that Serv-U is under attack

The beleaguered IT firm urges its customers to patch their FTP systems immediately

Hackers are triggering a vulnerability in the Serv-U Managed File Transfer (MFT) and Serv-U Secure File Transfer Protocol (FTP) products to attack SolarWinds customers. 

SolarWinds has released a hotfix to patch the remote code execution vulnerability - tracked as CVE-2021-35211 - after Microsoft researchers reported that it was involved in ongoing attacks against customers.

The company, which was at the centre of one of the biggest attacks in recent memory towards the end of last year, has urged its Serv-U customers to patch their systems immediately in order to benefit from the fix.

Serv-U is a suite of tools, maintained by SolarWinds, that allows customers to securely transfer files remotely across the web. Alongside Managed File Transfer and Secure FTP, the suite includes Serv-U Gateway, which adds a layer of security to file transfers.

Hackers can exploit the vulnerability to run arbitrary code with privileges on targeted systems, before installing programmes, altering or deleting data, and running programmes. The vulnerability exists in the latest Serv-U version 15.2.3 HF1, released on 5 May 2021, and all prior versions, with customers encouraged to update to Serv-U version 15.2.3 HF2.

No other SolarWinds products have been affected by this vulnerability, the company claims, with Microsoft providing evidence of limited, targeted customer impact by a single entity.

SolarWinds doesn’t have an estimate for how many customers have been affected, however, and it’s unaware of the identity of the current victims. 

Related Resource

X-Force Threat Intelligence Index

Top security threats and recommendations for resilience

Transparent cube against a black background - whitepaper from IBMFree download

The company has stressed this is a new vulnerability and not related to the supply chain attack that affected approximately 100 victims, at least. Investigations into that attack revealed that the hackers responsible had first infiltrated the company’s networks in September 2019, before injecting test code and beginning trial runs. 

SolarWinds had previously blamed an intern for setting a weak ‘solarwinds123’ password, which was publicly accessible on GitHub for more than a year, on a company server, which allowed hackers a route into the company’s networks.

Featured Resources

Four strategies for building a hybrid workplace that works

All indications are that the future of work is hybrid, if it's not here already

Free webinar

The digital marketer’s guide to contextual insights and trends

How to use contextual intelligence to uncover new insights and inform strategies

Free Download

Ransomware and Microsoft 365 for business

What you need to know about reducing ransomware risk

Free Download

Building a modern strategy for analytics and machine learning success

Turning into business value

Free Download

Recommended

Senate report slams agencies for poor cyber security
cyber security

Senate report slams agencies for poor cyber security

3 Aug 2021
Most employees put their workplace at risk by taking cyber security shortcuts
cyber security

Most employees put their workplace at risk by taking cyber security shortcuts

27 Jul 2021
61% of organizations say improving security a top priority for 2021
cyber security

61% of organizations say improving security a top priority for 2021

29 Jun 2021
ProtectedBy.AI’s CodeLock blocks malware at source code level
software as a service (SaaS)

ProtectedBy.AI’s CodeLock blocks malware at source code level

9 Jun 2021

Most Popular

Russian hackers declare war on 10 countries after failed Eurovision DDoS attack
hacking

Russian hackers declare war on 10 countries after failed Eurovision DDoS attack

16 May 2022
Windows Server admins say latest Patch Tuesday broke authentication policies
Server & storage

Windows Server admins say latest Patch Tuesday broke authentication policies

12 May 2022
Microsoft to double salary budget to retain workers
Careers & training

Microsoft to double salary budget to retain workers

17 May 2022