Read the docs
TI-2023-09641 Aliases CVE-2023-23842GHSA-4rx2-pvmr-h2r3

SolarWinds Network Configuration Manager Directory Traversal Vulnerability

Priority LOW 39CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

The SolarWinds Network Configuration Manager was susceptible to the Directory Traversal Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03248 88th percentileScored 2026-11-07
Fix Fixed Network Configuration Manager (SolarWinds): 2023.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SolarWindsNetwork Configuration Managerbefore 2023.32023.3Patch availableCNA
  • Network Configuration Manager VendorSolarWinds Affected before 2023.3 Fixed in 2023.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:solarwinds:network_configuration_monitor:*:*:*:*:*:*:*:*before 2023.3.0VulnerableSolarWinds
  • cpe:2.3:a:solarwinds:network_configuration_monitor:*:*:*:*:*:*:*:* Versions before 2023.3.0 Vulnerable ·SolarWinds

Remediation

  • Fix · CNA Network Configuration Manager (SolarWinds) Fixed in 2023.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-23842
  2. 2026-10-03 Alias added: GHSA-4rx2-pvmr-h2r3

References

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences