VMWare RCE

VMware has addressed a critical remote code execution (RCE) vulnerability in the vCenter Server virtual infrastructure management platform, tracked as CVE-2021-21972, that could be exploited by attackers to potentially take control of affected systems without any interaction of user

“The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.”. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.

The issue affects vCenter Server plugin for vROPs which is available in all default installations. vROPs does not need be present to have this endpoint available. The virtualization giant has provided workarounds to disable it.

The company recommends upgrading vulnerable vCenter Server installs to versions 6.5 U3n, 6.7 U3l, or 7.0 U1c as soon as possible.

VMware also addressed an important heap-overflow flaw, tracked as CVE-2021-21974, in VMware ESXi. The issue can be exploited by attackers to execute arbitrary code remotely on vulnerable devices.