Critical RCE Flaws Affect VMware ESXi and vSphere Client — Patch Now
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-19781 | Unauthenticated path traversal RCE in Citrix ADC, Gateway, and SD-WAN WANOP | 9.8 | 100% | KEVRansomware | KEV |
| CVE-2020-3992 | Use-After-Free RCE in VMware ESXi OpenSLP Service (Port 427) | 9.8 | 83% | KEVRansomware | KEV |
| CVE-2021-21972 | Unauthenticated RCE in VMware vCenter Server vSphere Client Plugin | 9.8 | 100% | KEVRansomwarePoC ×3 | KEV |
| CVE-2021-21973 | SSRF in VMware vCenter Server and Cloud Foundation (vSphere Client HTML5) | 5.3 | 88% | KEV | KEV |
| CVE-2021-21974 | OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overflow vulnerability | 8.8 | 45% | PoC | |
| CVE-2021-21976 | vSphere Replication 8.3.x prior to 8.3.1.2, 8.2.x prior to 8.2.1.1, 8.1.x prior to 8.1.2.3 and 6.5.x prior to 6.5.1.5 contain a post-authentication command… | 7.2 | 2% |
From the original article
2 min read at thehackernews.com
VMware has addressed multiple critical remote code execution (RCE) vulnerabilities in VMware ESXi and vSphere Client virtual infrastructure management platform that may allow attackers to execute arbitrary commands and take control of affected systems.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.