CVE-2021-21985criticalunder attackransomwareCWE-20CWE-470CWE-918

CVE-2021-21985: critical vulnerability in VMware vCenter Server and VMware Cloud…

Published · Updated

Follow this CVE+ Monitor VMware Cloud Foundation+ Monitor vCenter Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 100%
from disclosure to weapon1 day
Published on NVDMay 26
1st PoC+1d
metasploitMay 25
CISA KEV+161d
Action required by CISAfederal deadline: 2021-11-17

Apply updates per vendor instructions.

In short

vSphere Client has a remote code execution flaw in its Virtual SAN Health Check plugin that allows attackers on the network to run commands with full system privileges on the vCenter Server without authentication.

Technical detail

Unauthenticated remote code execution vulnerability in vSphere Client's Virtual SAN Health Check plugin (CWE-20, CWE-470, CWE-918) accessible via port 443 due to insufficient input validation. An attacker with network access can inject malicious payloads to execute arbitrary OS commands with unrestricted privileges on the underlying vCenter Server host.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · VMware vCenter Server and VMware Cloud Foundation
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.