VULNERABILITY INTELLIGENCE

CVE-2019-3980

CVSS score9.8 CRITICAL

EPSS probability5.18%

CISA KEVNot currently listed

Published2019-10-08

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The Solarwinds Dameware Mini Remote Client agent v12.1.0.89 supports smart card authentication which can allow a user to upload an executable to be executed on the DWRCS.exe host. An unauthenticated, remote attacker can request smart card login and upload and execute an arbitrary executable run under the Local System account.

Weakness classification

CWE-346: Origin Validation Error

Primary references

vulnreport@tenable.com — Third Party Advisory
vulnreport@tenable.com — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory