Serv-U FTP Service Directory Traversal Remote Code Execution Vulnerability 

Summary

SolarWinds Serv-U is vulnerable to a directory traversal vulnerability where remote code execution is possible depending on privileges given to the authenticated user. This issue requires a user to be authenticated. This is present when software environment variables are abused. Authentication is required for this vulnerability.

Affected Products

Serv-U 15.4.2 and previous versions

Fixed Software Release

Serv-U 15.5

Acknowledgments

Anonymous working with Trend Micro Zero Day Initiative