Security News > 2021 > February > Critical RCE Flaws Affect VMware ESXi and vSphere Client — Patch Now

VMware has addressed multiple critical remote code execution vulnerabilities in VMware ESXi and vSphere Client virtual infrastructure management platform that may allow attackers to execute arbitrary commands and take control of affected systems.

The vulnerability, tracked as CVE-2021-21972, has a CVSS score of 9.8 out of a maximum of 10, making it critical in severity.

"In our opinion, the RCE vulnerability in the vCenter Server can pose no less a threat than the infamous vulnerability in Citrix," said Positive Technologies' Mikhail Klyuchnikov, who discovered and reported the flaw to VMware.

Separately, a second vulnerability allows unauthorized users to send POST requests, permitting an adversary to mount further attacks, including the ability to scan the company's internal network and retrieve specifics about the open ports of various services.

It's worth noting that VMware rectified a command injection vulnerability in its vSphere Replication product earlier this month that could grant a bad actor with administrative privileges to execute shell commands and achieve RCE. Lastly, VMware also resolved a heap-overflow bug in ESXi's service location protocol, potentially allowing an attacker on the same network to send malicious SLP requests to an ESXi device and take control of it.

OpenSLP provides a framework to allow networking applications to discover the existence, location, and configuration of networked services in enterprise networks.

News URL

http://feedproxy.google.com/~r/TheHackersNews/~3/vbbWfPjXKcY/critical-rce-flaw-affects-vmware.html