CVE-2021-31474 is a critical deserialization vulnerability affecting SolarWinds Network Performance Monitor 2020.2.1. This flaw allows unauthenticated remote attackers to execute arbitrary code with SYSTEM privileges due to insufficient validation of user-supplied data within the SolarWinds.Serialization library. With a CVSS score of 9.8 (CRITICAL) and an EPSS score indicating high exploitability potential, the vulnerability presents a severe risk. While no public exploit code (Metasploit, Nuclei, ExploitDB) or active exploitation (KEV, Hot List) has been confirmed, and community discussion is minimal, the potential impact remains significant.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 2020.2.1, < 2020.2.5CPE matchmatch criteria | cpe:2.3:a:solarwinds:network_performance_monitor:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.