What is CVE-2021-35226?

CVE-2021-35226 is a medium-severity vulnerability in Solarwinds Network Configuration Manager, classified under Inadequate Encryption Strength. CVSS score: 6.5/10. Published 2022-10-10.

How severe is CVE-2021-35226?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Solarwinds Network Configuration Manager

CVE-2021-35226

An entity in Network Configuration Manager product is misconfigured and exposing password field to Solarwinds Information Service (SWIS). Exposed credentials are encrypted and require authenticated access with an NCM role.

EPSS: 0.005 (37.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Solarwinds Network Configuration Manager — versions 2020.2.5 and previous version
Solarwinds Network_configuration_manager

Weakness classification (CWE)

CWE-326 — Inadequate Encryption Strength

References

psirt@solarwinds.com (Patch, Vendor Advisory)

Frequently asked questions

What is CVE-2021-35226?: CVE-2021-35226 is a medium-severity vulnerability in Solarwinds Network Configuration Manager, classified under Inadequate Encryption Strength. CVSS score: 6.5/10. Published 2022-10-10.
How severe is CVE-2021-35226?: Medium severity. CVSS v3 base score is 6.5 out of 10.