Forwarded from Taiwan Computer Network Crisis Management and Coordination Center: Cybersecurity Alert TWCERTCC-200-202511-00000016

[Content Description]
SolarWinds Serv-U is a server software for secure file transfer, supporting multiple protocols such as FTP, FTPS, and SFTP. It features an easy-to-use management interface and supports cross-platform and cross-device access. Recently, SolarWinds released information that its Serv-U product contains three critical cybersecurity vulnerabilities.

【CVE-2025-40547, CVSS: 9.1】 This is a logic error vulnerability that could allow an attacker with administrator privileges to execute code.

【CVE-2025-40548, CVSS: 9.1】 This is a missing verification procedure vulnerability that could allow an attacker with administrator privileges to execute code. 【CVE-2025-40549, CVSS: 9.1】 This is a path restriction bypass vulnerability that could allow an attacker with administrator privileges to execute code on a directory.

[Affected Platforms]
SolarWinds Serv-U version 15.5.2.2.102

[Recommended Actions]
Please update to the following version: SolarWinds Serv-U version 15.5.3

[References]
1. https://www.twcert.org.tw/tw/cp-169-10519-a28f7-1.html