ASP.NET Debug Feature Enabled
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
The ASP.NET debug feature is enabled by default in Kiwi Syslog Server 9.7.2 and previous versions. ASP.NET allows remote debugging of web applications, if configured to do so. Debug mode causes ASP.NET to compile applications with extra information. The information enables a debugger to closely monitor and control the execution of an application. If an attacker could successfully start a remote debugging session, this is likely to disclose sensitive information about the web application and supporting infrastructure that may be valuable in targeting SWI with malicious intent.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SolarWinds | Kiwi Syslog Server | 9.7.2 and previous versions to before 9.8 | 9.8 | Patch available | CNA |
- Kiwi Syslog Server VendorSolarWinds Affected 9.7.2 and previous versions to before 9.8 Fixed in 9.8 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:solarwinds:kiwi_syslog_server:*:*:*:*:*:*:*:* | up to 9.7.2 | Vulnerable | SolarWinds |
- cpe:2.3:a:solarwinds:kiwi_syslog_server:*:*:*:*:*:*:*:* Versions up to 9.7.2 Vulnerable ·SolarWinds
Remediation
- Fix · CNA Kiwi Syslog Server (SolarWinds) Fixed in 9.8
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
SolarWinds Kiwi Syslog Server 9.8
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2021-14126 HTTP TRACK & TRACE Methods EnabledPriority LOW 26
- TI-2021-14129 Missing Secure Flag From SSL CookiePriority LOW 25
Timeline
- 2026-10-02 Threatist record created from CVE-2021-35235
- 2026-10-03 Alias added: GHSA-w85c-3fh8-gc58
References
More SolarWinds Kiwi Syslog Server vulnerabilities
- TI-2021-14124 Unquoted Path (SMB Login) Vulnerability CVSS 3.1MEDIUM 6.7
- TI-2021-14126 HTTP TRACK & TRACE Methods Enabled CVSS 3.1MEDIUM 5.3
- TI-2021-14130 Clickjacking in SolarWinds Kiwi Syslog Server CVSS 3.1MEDIUM 5.0
- TI-2021-14129 Missing Secure Flag From SSL Cookie CVSS 3.1MEDIUM 5.3
Sources
- CVE-2021-35235 · CVE Program
- CVE-2021-35235 · NVD
- FIRST EPSS
- GHSA-w85c-3fh8-gc58 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences