[Content]
Forwarded from TWCERTCC-200-202602-00000015

SolarWinds Serv-U is a server software used for secure file transfer. It supports multiple protocols including FTP, FTPS, and SFTP, provides an easy-to-use management interface, and supports cross-platform and cross-device access. Recently, SolarWinds announced that four critical security vulnerabilities have been identified in its Serv-U product.

【CVE-2025-40538, CVSS: 9.1】 This is an access control vulnerability that allows an attacker to create a system administrator account and execute arbitrary code with privileged account permissions through domain administrator or group administrator privileges.

【CVE-2025-40539, CVSS: 9.1】 This is a type confusion vulnerability that allows an attacker to execute arbitrary local code with privileged account permissions.

【CVE-2025-40540, CVSS: 9.1】 This is a type confusion vulnerability that allows an attacker to execute arbitrary local code with privileged account permissions.

【CVE-2025-40541, CVSS: 9.1】 This is an insecure direct object reference (IDOR) vulnerability that allows an attacker to execute arbitrary local code with privileged account permissions."

(Information Sharing Level: WHITE (Information content can be publicly disclosed)