Exploit / PoCcritical

Chinese Hackers Exploit VMware Zero-Day to Backdoor Windows and Linux Systems

The Hacker Newsby @TheHackersNewsJun 15, 2023 · 00:00 UTC (Jun 15, 2023)2 min read2

Read at thehackernews.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2023-20867 CVE-2023-20887 CVE-2023-20888 CVE-2023-20889

Tags: cve-2023-20867 cve-2023-20887 cve-2023-20888 cve-2023-20889 exploit

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2023-20867	Authentication Bypass in VMware Tools Lets Compromised ESXi Hosts Run Guest Operations	3.9	14%	KEV	Jun 13, 2023 KEV Jun 23, 2023
CVE-2023-20887	Unauthenticated Command Injection RCE in VMware Aria Operations for Networks	9.8	98%	KEVPoC	Jun 7, 2023 KEV Jun 22, 2023
CVE-2023-20888 +1 related CVE CVE-2023-20889	Aria Operations for Networks contains an authenticated deserialization vulnerability	8.8 group max	82%		Jun 7, 2023

From the original article

2 min read at thehackernews.com

 Ravie Lakshmanan  Jun 14, 2023 Zero-Day / Network Security The Chinese state-sponsored group known as UNC3886 has been found to exploit a zero-day flaw in VMware ESXi hosts to backdoor Windows and Linux systems. The VMware Tools authentication bypass vulnerability, tracked as CVE-2023-20867 (CVSS score: 3.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.