一、 漏洞 CVE-2025-40547 基础信息

                                        # Serv-U 逻辑滥用远程代码执行漏洞

## 概述

Serv-U 中存在一个逻辑错误漏洞，攻击者若具备管理员权限，可利用该漏洞执行任意代码。

## 影响版本

未明确具体版本，但漏洞存在于 Serv-U 产品中。

## 细节

该漏洞是由于 Serv-U 的逻辑处理不当，在具有管理员访问权限的条件下可以被滥用，从而实现代码执行。

## 影响

漏洞利用需要管理员权限。在 Windows 部署环境中，由于服务通常默认以低权限服务账户运行，因此风险评级为中等。
                                        

二、漏洞 CVE-2025-40547 的公开POC

三、漏洞 CVE-2025-40547 的情报信息

• https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40547

• 标题： Serv-U 15.5.3 release notes -- 🔗来源链接

  标签：

  神龙速读：

                                          ### 关键漏洞信息
  
  #### SolarWinds CVEs
  
  | CVE-ID    | Vulnerability Title               | Description                                                                                                                                                                                                                      | Severity | Credit     |
  |-----------|--------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------|------------|
  | CVE-2025-40547 | Logic Abuse - Remote Code Execution Vulnerability | A logic error vulnerability exists in Serv-U, which when abused, could give a malicious actor with access to admin privileges the ability to execute code. This issue requires administrative privileges to abuse. | Critical | 9.1        |
  | CVE-2025-40548 | Broken Access Control - Remote Code Execution Vulnerability | A missing validation process exists in Serv-U, which when abused, could give a malicious actor with access to admin privileges the ability to execute code. This issue requires administrative privileges to abuse. | Critical | 9.1        |
  | CVE-2025-40549 | Path Restriction Bypass Vulnerability                       | A Path Restriction Bypass vulnerability exists in Serv-U that when abused, could give a malicious actor with access to admin privileges the ability to execute code on a directory. This issue requires administrative privileges to abuse. | Critical | 9.1        |
  
  #### 解决的客户问题
  
  | Case number | Description                                                                                                                                                                                                                                                                                          |
  |-------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
  | N/A         | An error alert again displays after multi-factor authentication (MFA) when Web Client and File Sharing are disabled for the user.                                                                                                                                                                         |
  | N/A         | Serv-U no longer ignores listeners created to accept client connections.                                                                                                                                                                                                                               |
  | N/A         | Case-insensitive counting for ASCII usernames was implemented to prevent brute force attempts that exceed limits.                                                                                                                                                                                              |
  | N/A         | Serv-U now prevents attacks by blocking the processing of specially crafted URLs designed to create XSS vulnerabilities.                                                                                                                                                                                     |
  | N/A         | 'Unsafe-inline' was removed from the style-src directive, and nonce was applied to style elements. Inline styles were refactored to CSS classes, and the cdk-virtual-scroll-viewport component was replaced with standard Nova-UI table implementations for better Content Security Policy (CSP) compliance. |
  | 01985676    | Serv-U suggests available space identified for \\OneHost\DirectoryForHome.                                                                                                                                                                                                                             |
  | 01984223    | Serv-U continues to operate as expected when it allows LDAP users.                                                                                                                                                                                                                                     |
                                          

  
• https://nvd.nist.gov/vuln/detail/CVE-2025-40547

四、漏洞 CVE-2025-40547 的评论