# CVE-2024-28987: SolarWinds - Information Disclosure

> Live exploitation tracking for CVE-2024-28987 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2024-28987

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.1
- **Public exploit available:** Yes
- **Affected products:** SolarWinds Web Help Desk
- **Weaknesses:** CWE-798 (Use of Hard-coded Credentials)
- **Tags:** enterprise_software

## Description

The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.

## CrowdSec analysis

The SolarWinds Web Help Desk software is impacted by a hardcoded credential vulnerability, tracked as [CVE-2024-28987](https://euvd.enisa.europa.eu/vulnerability/CVE-2024-28987). This vulnerability could allow remote, unauthenticated attackers to access internal system functionality and modify sensitive data. This flaw exposes organizations to risks such as unauthorized data manipulation, privilege escalation, and potential further compromise of the help desk environment.

CrowdSec has been tracking this vulnerability and its exploits since 25th of October 2024.

CrowdSec has not observed any significant exploitation activity targeting CVE-2024-28987 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit SolarWinds Web Help Desk by sending requests to `/helpdesk/WebObjects/Helpdesk.woa/ra/OrionTickets/` using hardcoded credentials, allowing unauthorized access to sensitive ticket data.

## Timeline

- 2024-08-21: CVE Published. CVE-2024-28987 is published to NVD.
- 2024-10-15: CISA KEV. CVE-2024-28987 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2024-10-25: Rule Released. CrowdSec releases a rule to detect CVE-2024-28987 exploitation attempts against the CrowdSec Network.
- 2024-11-05: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2025-12-17: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2024-28987 for the first time.

## References

- https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28987
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-28987.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2024-28987) follows observed exploitation activity for CVE-2024-28987. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.