SolarWinds Web Help Desk Security Control Bypass Vulnerability (CVE-2025-40536) Urgent Security Advisory

# 1. Stop the Web Help Desk service
sudo service webhelpdesk stop

# 2. Create a backup of the current installation and database configurations
tar -czvf whd_backup_$(date +%F).tar.gz /usr/local/webhelpdesk

# 3. Install the latest secure package (Download 2026.1+ from SolarWinds Customer Portal)
# rpm -Uvh SolarWinds-WHD-2026.1.x86_64.rpm

# 4. Restart the service and verify status
sudo service webhelpdesk start
sudo service webhelpdesk status

# Restrict access to WHD port (default 8443) using iptables, allowing only a trusted admin IP (e.g., 192.168.10.50)
sudo iptables -A INPUT -p tcp -s 192.168.10.50 --dport 8443 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 8443 -j DROP

# Example Nginx reverse proxy configuration to restrict access to the /whd path:
# Add to /etc/nginx/conf.d/whd.conf:
# location /whd/ {
#     allow 192.168.10.0/24;
#     deny all;
# }

# Search for unauthorized access attempts to administrative or system endpoints returning 200 OK
grep -Ei '(/whd/system/|/whd/admin/)' /usr/local/webhelpdesk/logs/access_log* | grep ' 200 '

# Verify the currently installed Web Help Desk version\cat /usr/local/webhelpdesk/version.txt 2>/dev/null || echo 'Unable to determine version. Manual check required.'