RansomwarecriticalExploited in the wild

Plug critical VMware vCenter Server flaw before ransomware gangs start exploiting it (CVE-2021-22005)

Help Net Securityby @zeljkazorzSep 29, 2021 · 14:29 UTC (Sep 29, 2021)4 min read14 · 4 reads

Read at helpnetsecurity.com

Analyze CVE-2021-22005 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2021-22005 CVE-2021-21985 CVE-2021-21972

Tags: cve-2021-22005 cve-2021-21985 cve-2021-21972 ransomware

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2021-21972	Unauthenticated RCE in VMware vCenter Server vSphere Client Plugin	9.8	100%	KEVRansomwarePoC ×3	Feb 24, 2021 KEV Nov 3, 2021
CVE-2021-21985	Remote Code Execution in VMware vCenter Server vSAN Health Check plug-in	9.8	100%	KEVRansomwarePoC	May 26, 2021 KEV Nov 3, 2021
CVE-2021-22005	Path Traversal File Upload RCE in VMware vCenter Server (Analytics Service)	9.8	100%	KEVRansomwarePoC	Sep 23, 2021 KEV Nov 3, 2021

From the original article

4 min read at helpnetsecurity.com

VMware has fixed 19 vulnerabilities affecting VMware vCenter Server and VMware Cloud Foundation, the most critical of which is CVE-2021-22005. “This vulnerability can be used by anyone who can reach vCenter Server over the network to gain access, regardless of the configuration settings of vCenter Server,” the company noted .

Help Net Security

By @zeljkazorz · helpnetsecurity.com

Read the full article at Help Net Security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.