CVE-2023-20887criticalunder attackCWE-77

CVE-2023-20887: critical vulnerability in Aria Operations for Networks (Formerly…

Published · Updated

Follow this CVE+ Monitor Aria Operations for Networks+ Monitor Aria Operations for Networks

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 98%
from disclosure to weapon6 days
Published on NVDJun 7
1st PoC+6d
metasploitJun 7
CISA KEV+15d
Action required by CISAfederal deadline: 2023-07-13

Apply updates per vendor instructions.

In short

VMware Aria Operations for Networks has a flaw that allows attackers on the network to inject malicious commands and run arbitrary code on the system. This is critical because it can lead to complete system compromise without requiring any special credentials.

Technical detail

CWE-77 command injection vulnerability in VMware Aria Operations for Networks allows an attacker with network access to inject OS commands through unvalidated input, resulting in unauthenticated remote code execution with system-level privileges. The attack requires only network connectivity to the vulnerable service.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · Aria Operations for Networks (Formerly vRealize Network Insight)
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.