[Content]
Forwarded from TWCERTCC-200-202511-00000016

SolarWinds Serv-U is a server software designed for secure file transfer, supporting multiple protocols such as FTP, FTPS, and SFTP. It offers an easy-to-use management interface and supports cross-platform and cross-device access. Recently, SolarWinds announced that its Serv-U product contains three critical security vulnerabilities.

【CVE-2025-40547, CVSS: 9.1】 This is a logic error vulnerability that may allow an attacker with administrator privileges to execute code.

【CVE-2025-40548, CVSS: 9.1】 This is a missing validation process vulnerability that may allow an attacker with administrator privileges to execute code.

【CVE-2025-40549, CVSS: 9.1】 This is a path restriction bypass vulnerability that may allow an attacker with administrator privileges to execute code within directories.

Information Sharing Level: WHITE (Information content can be publicly disclosed)