{"id":"CVE-2025-40537","state":"PUBLISHED","title":"SolarWinds Web Help Desk Hardcoded Credentials Vulnerability","description":"SolarWinds Web Help Desk was found to be susceptible to a hardcoded credentials vulnerability that, under certain situations, could allow access to administrative functions.","publishedAt":"2026-01-28T07:31:41.994Z","updatedAt":"2026-02-26T15:04:49.393Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"SolarWinds"},"assigner":"SolarWinds","products":["SolarWinds Web Help Desk"],"affected":[{"vendor":"SolarWinds","product":"Web Help Desk","defaultStatus":"affected","versions":[{"version":"12.8.8 HF1 and below","status":"affected"}]}],"references":["https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40537","https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm"],"weaknesses":["CWE-798"],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/40xxx/CVE-2025-40537.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-40537","state":"PUBLISHED","datePublished":"2026-01-28T07:31:41.994Z","dateUpdated":"2026-02-26T15:04:49.393Z","assignerShortName":"SolarWinds","assignerOrgId":"49f11609-934d-4621-84e6-e02e032104d6","dateReserved":"2025-04-16T08:00:57.647Z"},"containers":{"cna":{"title":"SolarWinds Web Help Desk Hardcoded Credentials Vulnerability","descriptions":[{"lang":"en","value":"SolarWinds Web Help Desk was found to be susceptible to a hardcoded credentials vulnerability that, under certain situations, could allow access to administrative functions."}],"affected":[{"vendor":"SolarWinds","product":"Web Help Desk","defaultStatus":"affected","versions":[{"version":"12.8.8 HF1 and below","status":"affected"}]}],"references":[{"url":"https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40537","tags":["vendor-advisory","patch"]},{"url":"https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm","tags":["release-notes"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-798","description":"CWE-798 Use of Hard-coded Credentials","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"SolarWinds","orgId":"49f11609-934d-4621-84e6-e02e032104d6","dateUpdated":"2026-01-28T07:31:41.994Z"},"credits":[{"lang":"en","type":"reporter","user":"00000000-0000-4000-9000-000000000000","value":"Jimi Sebree working with Horizon3.ai"}],"datePublic":"2026-01-28T07:31:00.000Z","impacts":[{"capecId":"CAPEC-70","descriptions":[{"lang":"en","value":"CAPEC-70 Try Common or Default Usernames and Passwords"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"SolarWinds recommends customers upgrade to Web Help Desk version 2026.1, and to follow the steps in the guide to unlink the demo client from the admin user. The guide can be found in the release notes and the Web Help Desk Secure Configuration guide, which can be found here:&nbsp;<a target=\"_blank\" rel=\"nofollow\" href=\"https://documentation.solarwinds.com/en/success_center/whd/content/helpdesksecureconfiguration.htm\">https://documentation.solarwinds.com/en/success_center/whd/content/helpdesksecureconfiguration.htm</a>.<br>"}],"value":"SolarWinds recommends customers upgrade to Web Help Desk version 2026.1, and to follow the steps in the guide to unlink the demo client from the admin user. The guide can be found in the release notes and the Web Help Desk Secure Configuration guide, which can be found here:  https://documentation.solarwinds.com/en/success_center/whd/content/helpdesksecureconfiguration.htm https://documentation.solarwinds.com/en/success_center/whd/content/helpdesksecureconfiguration.htm ."}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-40537","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-02-03T04:55:33.662870Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-26T15:04:49.393Z"}}]}}}