Critical RCE CVE-2023-20887 in VMware vRealize exploited in the wild
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-20887 | Unauthenticated Command Injection RCE in VMware Aria Operations for Networks VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection flaw (CWE-77) that allows an attacker with network access to the appliance to run arbitrary operating-system commands. Because the attack requires no authentication, privileges, or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), any party able to reach the product's network interface can trigger it, gaining remote code execution with high impact on confidentiality, integrity, and availability. Any organization running the product is affected, with internet-facing deployments at the greatest risk. Exploitation is confirmed in the wild — CISA added the flaw to the KEV catalog on 2023-06-22, a public proof-of-concept exploit is available, and EPSS puts the 30-day exploitation probability at 98.3% (top percentile). Ransomware use is currently unknown. Do: Apply the vendor's patched update to all Aria Operations for Networks deployments as soon as possible — this is also CISA's required KEV action (apply updates per vendor instructions); verify the installed build against VMware's advisory for affected ranges. Until patching is complete, restrict network access to the appliance (firewall rules, VPN, or management-segment isolation), prioritizing any instance reachable from the internet since no authentication is required to exploit. Hunt for indicators of command injection exploitation, as in-the-wild exploitation has been confirmed. | 9.8 | 98% | KEV PoC |
| moderate≈10,000+ appliance deployments worldwide (low tens of thousands of appliance nodes); only a small fraction, likely hundreds to low thousands of instances, are… |
Full article261 words · extracted from securityaffairs.com · click to collapse
VMware is warning customers that critical remote code execution vulnerability CVE-2023-20887 is being actively exploited in attacks.
VMware is warning customers that a critical remote code execution vulnerability in Aria Operations for Networks (Formerly vRealize Network Insight), tracked as CVE-2023-20887, is being actively exploited in the wild.
“VMware has confirmed that exploitation of CVE-2023-20887 has occurred in the wild,” reads the advisory.
In early June, Virtualization technology giant VMware released security patches to address three critical and high-severity vulnerabilities, including the flaw CVE-2023-20887.
VMware Aria Operations for Networks (formerly vRealize Network Insight) is a network monitoring tool that helps organizations build an optimized, highly available, and secure network infrastructure.
The vulnerability CVE-2023-20887 (CVSSv3 score of 9.8) is the most severe issue addressed by the company, it is a Command Injection flaw.
“A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.” reads the advisory published by VMware.
GreyNoise CEO Andrew Morris confirmed that the flaw is actively exploited in the wild.
We're observing exploitation of VMWare CVE-2023-20887 in @GreyNoiseIO 👀 https://t.co/Xz1pWgdQFm pic.twitter.com/puaVDDJGo5
— Andrew Morris (@Andrew___Morris) June 20, 2023
The attacks observed by GreyNoise started on June 13 and originated from 2 IP addresses.
Researchers pointed out that POC exploit code for the CVE-2023-20887 flaw is available online.
🚨 #VMWare Pre-Authenticated Remote Code Execution (CVE-2023-20887) #PoC is ready pic.twitter.com/6fi4keigOE
— SinSinology (@SinSinology) June 13, 2023
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, VMware)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/147668/hacking/vmware-cve-2023-20887-flaw-attacks.html