CVE-2021-38647criticalunder attackransomware

CVE-2021-38647: critical vulnerability in Microsoft Open Management Infrastructure

Open Management Infrastructure (OMI) Remote Code Execution Vulnerability

Published · Updated

Follow this CVE+ Monitor Azure Stack Hub+ Monitor System Center Operations Manager

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 100%
from disclosure to weaponsame day
Published on NVDSep 15
1st PoCSep 15
metasploitSep 14
CISA KEV+49d
Action required by CISAfederal deadline: 2021-11-17

Apply updates per vendor instructions.

In short

A critical vulnerability in Open Management Infrastructure allows attackers to execute arbitrary code remotely without needing valid credentials. This can completely compromise an affected system.

Technical detail

Unauthenticated remote code execution in Open Management Infrastructure via network-accessible endpoints; attackers can exploit this without authentication to achieve arbitrary code execution with system privileges. Pre-condition: the OMI service must be exposed and running; impact includes full system compromise and potential lateral movement in enterprise environments.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Affected products
Microsoft · Azure Automation State Configuration, DSC ExtensionMicrosoft · Azure Automation Update ManagementMicrosoft · Azure Diagnostics (LAD)Microsoft · Azure Security CenterMicrosoft · Azure SentinelMicrosoft · Azure Stack HubMicrosoft · Container Monitoring SolutionMicrosoft · Log Analytics AgentMicrosoft · Open Management InfrastructureMicrosoft · System Center Operations Manager (SCOM)
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Microsoft Open Management Infrastructure

In the same product, most dangerous first.

CVE-2021-38648HIGHOpen Management Infrastructure Elevation of Privilege VulnerabilityEPSS 11.4%KEVCVE-2021-38649HIGHOpen Management Infrastructure Elevation of Privilege VulnerabilityEPSS 2.9%KEVCVE-2021-38645HIGHOpen Management Infrastructure Elevation of Privilege VulnerabilityEPSS 2.7%KEVCVE-2024-21330HIGHOpen Management Infrastructure (OMI) Elevation of Privilege VulnerabilityEPSS 1.0%CVE-2022-29149HIGHOpen Management Infrastructure (OMI) Elevation of Privilege VulnerabilityEPSS 1.0%