important · SolarWinds ARM
A universal SolarWinds ARM secret turns TCP/55555 reachability into LocalSystem execution.
Affects
SolarWinds Access Rights Manager, enterprise identity-governance software running on Windows servers.
The listener permits TLS without a client certificate, and the shipped key mints its fallback authentication token. ARM then borrows a locally registered identity and accepts a .NET Remoting message at a BinaryFormatter sink.
Detail and 3 sources
Bishop Fox demonstrated NT AUTHORITY\SYSTEM execution in a lab.