CVE-2021-22005criticalunder attackransomwareCWE-22

CVE-2021-22005: critical vulnerability in VMware vCenter Server, VMware Cloud Foundation

Published · Updated

Follow this CVE+ Monitor VMware Cloud Foundation+ Monitor vCenter Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 100%
from disclosure to weaponsame day
Published on NVDSep 23
1st PoCSep 23
metasploitSep 21
CISA KEV+41d
Action required by CISAfederal deadline: 2021-11-17

Apply updates per vendor instructions.

In short

vCenter Server has a flaw in its Analytics service that allows anyone on the network to upload malicious files and take control of the server. This is critical because vCenter Server manages all virtual machines in a data center.

Technical detail

CWE-22 arbitrary file upload vulnerability in vCenter Analytics service accessible via port 443 (HTTPS). An unauthenticated network attacker can upload a specially crafted file to achieve remote code execution. The vulnerability requires only network access to the affected service, making it highly exploitable with no authentication barriers.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · VMware vCenter Server, VMware Cloud Foundation
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.