Solar Winds Serv-U (CVE-2024-28995) exploitation: We see you! | Grey Noise Blog

Summary: On June 5, 2024, SolarWinds published an advisory for CVE-2024-28995, a path-traversal vulnerability in Serv-U discovered by Hussein Daher. GreyNoise Labs deployed a new honeypot to observe exploitation and tracked one live attacker over four hours, including repeated copy/paste mistakes, a failed attempt to correct the exploit, and one instance of sending the wrong exploit entirely.
What you should know: A single attacker spent four hours fumbling a path-traversal exploit against a honeypot, which means real Serv-U instances are being probed by actors who keep trying after they fail.

Read the original at GreyNoise Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2024-28995
Related: CVE-2024-28995: Solar Winds Serv-U Path Traversal Vulnerability Known Exploited Vulnerabilities · Jul 17, 2024
What Are Hackers Searching for in Solar Winds Serv-U (CVE-2024-28995)? Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026