Vulnerabilitycritical
China-linked group Fire Ant exploits VMware and F5 flaws since early 2025
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-1388 | Unauthenticated RCE in F5 BIG-IP via Missing Authentication | 9.8 | 100% | KEVRansomwarePoC ×4 | KEV |
| CVE-2023-20867 | Authentication Bypass in VMware Tools Lets Compromised ESXi Hosts Run Guest Operations | 3.9 | 14% | KEV | KEV |
| CVE-2023-34048 | Unauthenticated Out-of-Bounds Write RCE in VMware vCenter Server | 9.8 | 99% | KEVPoC | KEV |
From the original article
3 min read at securityaffairs.com
China-linked group Fire Ant exploits VMware and F5 flaws to stealthily breach secure systems, reports cybersecurity firm Sygnia. China-linked cyberespionage group Fire Ant is exploiting VMware and F5 vulnerabilities to stealthily access secure, segmented systems, according to Sygnia. Since early 2025, the group has targeted virtualization and networking infrastructure, primarily VMware ESXi and vCenter environments.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.