Hard-Coded Key in SolarWinds ARM Enables Unauthenticated Remote Code Execution
Written by AI from the linked story. Not reviewed by an editor. How this works
SolarWinds Access Rights Manager contained a hard-coded static cryptographic key — a fundamental secure development failure — that allowed any unauthenticated attacker to achieve remote code execution with a CVSS score of 8.8. Hard-coded credentials and keys are a well-known anti-pattern that bypass all authentication controls, effectively leaving a permanent backdoor built into the product itself. This is particularly dangerous in Access Rights Manager software, which is designed to control and audit privileged access across an organization, meaning a compromise could cascade into full environment takeover. The recurrence of critical CVEs across multiple SolarWinds products (ARM, Web Help Desk, Serv-U) highlights systemic secure development lifecycle (SDLC) gaps. Organizations relying on this software for privileged access governance face compounded risk if patching is delayed.
Tactical Insight
Immediate Actions
- Apply SolarWinds ARM security updates immediately, prioritizing any internet-facing or privileged-network-adjacent deployments.
- Audit firewall and network access rules to restrict ARM management interfaces to trusted administrative networks only.
- Scan your environment for other SolarWinds products (Web Help Desk, Serv-U) and apply all recent security patches.
Long-Term Improvements
- Enforce a Secure Development Lifecycle (SDLC) policy — for vendors and internal teams — that explicitly prohibits hard-coded credentials and static cryptographic keys via automated code scanning.
- Maintain a continuously updated software asset inventory so critical vendor patches can be triaged and deployed within defined SLA windows (e.g., 24–72 hours for CVSS ≥ 8.0).
- Implement privileged access segmentation so that access management tools like ARM operate in isolated network zones with strict east-west traffic controls.
Detection Measures
- Enable detailed logging on ARM and adjacent identity systems and forward logs to a SIEM to detect anomalous authentication attempts or unexpected RCE indicators.
- Subscribe to SolarWinds security advisories and CISA KEV (Known Exploited Vulnerabilities) catalog alerts to receive timely notification of newly disclosed flaws.