Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
The Solarwinds Dameware Mini Remote Client agent v12.1.0.89 supports smart card authentication which can allow a user to upload an executable to be executed on the DWRCS.exe host. An unauthenticated, remote attacker can request smart card login and upload and execute an arbitrary executable run under the Local System account.
Priority
HIGH
Exploitation
ACTIVE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
We are still seeing this on engagements, so I wrote a tool. DameFlare is a Python 3 exploit for CVE-2019-3980. Unauthenticated RCE as SYSTEM via smart card auth bypass. Full credit to @TenableSecurity for the original research/POC. https://github.com/boydhacks/dameflare
Post summary
The post shares the DameFlare Python 3 exploit for CVE‑2019‑3980, notes it is being used in live engagements, and links to the code repository.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | solarwinds | dameware_mini_remote_control | 12.1.0.89 | - | - |