{"id":"CVE-2020-7984","aliases":["EUVD-2020-28900","GHSA-7p49-67wq-cw28"],"status":"published","title":"SolarWinds N-central before 12.1 SP1 HF5 and 12.2 before SP1 HF2 allows remote attackers to...","description":"SolarWinds N-central before 12.1 SP1 HF5 and 12.2 before SP1 HF2 allows remote attackers to retrieve cleartext domain admin credentials from the Agent \u0026 Probe settings, and obtain other sensitive information. The attacker can use a customer ID to self register and read any aspects of the agent/appliance configuration.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02475,"percentile":0.84665,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-319"],"published":"2020-01-26T20:04:06Z","modified":"2026-06-17T03:25:44Z","products":[{"vendor":"solarwinds","product":"n-central"}],"references":[{"url":"https://blog.huntresslabs.com/validating-the-solarwinds-n-central-dumpster-diver-vulnerability-5e3a045982e5","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory"]},{"url":"https://www.crn.com/news/managed-services/solarwinds-rmm-tool-has-open-zero-day-exploit-huntress-labs","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://success.solarwindsmsp.com/kb/solarwinds_n-central/How-to-Expunge-credentials-for-Customer-levels-of-SolarWinds-N-central","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory"]},{"url":"https://community.solarwindsmsp.com/Support/Software-Downloads/MSP-N-Central/MSP-N-central-12-2-SP1-HF2","tags":["x_refsource_MISC","x_transferred","Permissions Required","Vendor Advisory"]},{"url":"https://community.solarwindsmsp.com/Support/Software-Downloads/MSP-N-Central/MSP-N-central-12-1-SP1-HF5","tags":["x_refsource_MISC","x_transferred","Permissions Required","Vendor Advisory"]},{"url":"https://github.com/flipflopfpv","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://packetstormsecurity.com/files/156033","tags":["x_refsource_MISC","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://twitter.com/SecurityNewsbot/status/1219722631898812416","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7984"},{"url":"https://github.com/advisories/GHSA-7p49-67wq-cw28"}],"sources":{"cve":[{"id":"CVE-2020-7984","description":"SolarWinds N-central before 12.1 SP1 HF5 and 12.2 before SP1 HF2 allows remote attackers to retrieve cleartext domain admin credentials from the Agent \u0026 Probe settings, and obtain other sensitive information. The attacker can use a customer ID to self register and read any aspects of the agent/appliance configuration.","status":"published","published":"2020-01-26T20:04:06Z","modified":"2024-08-04T09:48:24.994Z","updated_at":"2026-11-02T14:35:58.331892Z"}],"euvd":[{"id":"EUVD-2020-28900","description":"SolarWinds N-central before 12.1 SP1 HF5 and 12.2 before SP1 HF2 allows remote attackers to retrieve cleartext domain admin credentials from the Agent \u0026 Probe settings, and obtain other sensitive information. The attacker can use a customer ID to self register and read any aspects of the agent/appliance configuration.","status":"published","published":"2020-01-26T20:04:06Z","modified":"2024-08-04T09:48:24Z","updated_at":"2026-11-03T03:07:58.506831Z"}],"ghsa":[{"id":"GHSA-7p49-67wq-cw28","title":"SolarWinds N-central before 12.1 SP1 HF5 and 12.2 before SP1 HF2 allows remote attackers to...","description":"SolarWinds N-central before 12.1 SP1 HF5 and 12.2 before SP1 HF2 allows remote attackers to retrieve cleartext domain admin credentials from the Agent \u0026 Probe settings, and obtain other sensitive information. The attacker can use a customer ID to self register and read any aspects of the agent/appliance configuration.","status":"published","published":"2022-05-24T17:07:22Z","modified":"2023-01-29T05:01:12Z","updated_at":"2026-11-02T14:44:45.404949Z"}],"nvd":[{"id":"CVE-2020-7984","description":"SolarWinds N-central before 12.1 SP1 HF5 and 12.2 before SP1 HF2 allows remote attackers to retrieve cleartext domain admin credentials from the Agent \u0026 Probe settings, and obtain other sensitive information. The attacker can use a customer ID to self register and read any aspects of the agent/appliance configuration.","status":"published","published":"2020-01-26T21:15:10.387Z","modified":"2026-06-17T03:25:44.447Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-319"],"updated_at":"2026-11-02T14:05:52.385274Z"}]}}