CVE-2021-25275

No known exploitation. EPSS puts it in the 48th percentile. Fixed in 2020.2.4.

CVSS 3.17.8High EPSS percentile48th0.6% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix2020.2.4Upgrade to this build

Published 2021-02-03Updated 2024-11-21Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Solarwinds Orion PlatformAffected: < 2020.2.4Upgrade to: 2020.2.4Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your SolarWinds Orion Platform version is earlier than 2020.2.4.
Restrict server and file-system access to approved administrators while the upgrade is scheduled.
Upgrade SolarWinds Orion Platform to version 2020.2.4 or later.
Change the Orion database credentials after upgrading and review Orion administrator accounts for unexpected changes.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

SolarWinds Orion Platform before 2020.2.4, as used by various SolarWinds products, installs and uses a SQL Server backend, and stores database credentials to access this backend in a file readable by unprivileged users. As a result, any user having access to the filesystem can read database login details from that file, including the login name and its associated password. Then, the credentials can be used to get database owner access to the SWNetPerfMon.DB database. This gives access to the data collected by SolarWinds applications, and leads to admin access to the applications by inserting or changing authentication data stored in the Accounts table of the database.

In plain language

Written by AI from the record

SolarWinds Orion Platform before 2020.2.4 can expose its database password to a person with access to the server, so affected small businesses should plan an upgrade.

A local low-privilege user can read hard-coded SQL Server credentials and use database-owner access to alter Orion application authentication data.

If you're affected

Monitoring data exposure
Orion administrator takeover
Unauthorized account changes
Service disruption

What is it

This issue leaves a database username and password in a file that ordinary server users can read. It is like leaving the master key to your monitoring system in an unlocked staff drawer: someone who can get into the building may use it to access records and change who has administrator access.

Who is affected

This matters to you if you run SolarWinds Orion Platform on a server with other users or accounts that do not need administrator-level access. It is only a risk if an attacker or unauthorized person can access that server's file system.

How urgent is it

No confirmed real-world exploitation or public attack code is recorded, which supports an amber priority rather than an emergency response. Schedule the upgrade promptly, especially on shared or broadly accessible Orion servers, because a user who gains server access can escalate into control of the Orion application.

What to do — in detail

Confirm the installed Orion Platform release in the SolarWinds administration interface or installed-product records, and identify any systems running a release earlier than 2020.2.4. Upgrade affected instances to 2020.2.4 or a later supported release using SolarWinds' normal upgrade process; validate compatibility and back up the Orion database before the change because later platform upgrades may have product-specific prerequisites.

If patching must wait, limit interactive and remote access to the Orion server, ensure unprivileged accounts cannot read the file containing the database credentials, and remove unnecessary local users. After upgrading, rotate the SQL Server credentials used by Orion, review the Accounts table or Orion administrator-account history for unauthorized additions or changes, and investigate unexpected database logins. CISA KEV does not list this CVE, so there is no CISA remediation due date.

Technical context

CVE-2021-25275 is rated CVSS 7.8 High (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is classified as CWE-798, use of hard-coded credentials. Orion Platform releases before 2020.2.4 store SQL Server backend credentials in a file readable by unprivileged local users; those credentials can provide database-owner access to SWNetPerfMon.DB and permit modification of application authentication data. It is not listed in CISA KEV, no public exploit code is on record, and EPSS is 0.6% (47th percentile) with a flat trend.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS48th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.6% chance of exploitation activity in the next 30 days, which ranks it in the 48th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

5 events over 1968 days, from the signal feeds we watch.

2026-06-25OpenVAS check added
2024-11-21Record updated
2021-02-03Publishedweakness classified, att&ck mapped

Affected products

solarwindscommercial · USaka solar winds
- orion platformWeb AppOn-premEnterprise Software / itsm-monitoring

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable