CVE-2023-40054

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows a low-level user to perform the actions with SYSTEM privileges. We found this issue was not resolved in CVE-2023-33226

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
SolarWinds	Network Configuration Manager	2023.4 and previous versions
solarwinds	network_configuration_manager	<= 2023.4

References

https://documentation.solarwinds.com/en/success_center/ncm/content/release_notes/ncm_2023-4-1_release_notes.htmRelease Notes, Vendor Advisory
https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-40054Vendor Advisory
https://documentation.solarwinds.com/en/success_center/ncm/content/release_notes/ncm_2023-4-1_release_notes.htmRelease Notes, Vendor Advisory
https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-40054Vendor Advisory

Timeline

Published: Nov 9, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-400558.8The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows a CVE-2023-400568.8SQL Injection Remote Code Vulnerability was found in the SolarWinds Platform. This vulnerability can be exploited with a low privileged acco CVE-2023-400579.0The SolarWinds Access Rights Manager was found to be susceptible to a Remote Code Execution Vulnerability. If exploited, this vulnerability CVE-2023-400586.5Sensitive data was added to our public-facing knowledgebase that, if exploited, could be used to access components of Access Rights Manager CVE-2023-40069.8Improper Neutralization of Formula Elements in a CSV File in GitHub repository thorsten/phpmyfaq prior to 3.1.16.CVE-2023-400607.2A vulnerability has been identified within Serv-U 15.4 and 15.4 Hotfix 1 that, if exploited, allows an actor to bypass multi-factor/two-fact CVE-2023-400618.8Insecure job execution mechanism vulnerability. This vulnerability can lead to other attacks as a result.CVE-2023-400628.8SolarWinds Platform Incomplete List of Disallowed Inputs Remote Code Execution Vulnerability. If executed, this vulnerability would allow a CVE-2023-400675.7Unchecked return value in firmware for some Intel(R) CSME may allow an unauthenticated user to potentially enable escalation of privilege vi CVE-2023-400685.4Cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 CVE-2023-400699.8OS command injection vulnerability in ELECOM wireless LAN routers allows an attacker who can access the product to execute an arbitrary OS c CVE-2023-40075.4Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.16.