Security News > 2021 > February > Attackers are looking to exploit critical VMware vCenter Server RCE flaw, patch ASAP!

The day after VMware released fixes for a critical RCE flaw found in a default vCenter Server plugin, opportunistic attackers began searching for publicly accessible vulnerable systems.

We've detected mass scanning activity targeting vulnerable VMware vCenter servers.

"In our opinion, the RCE vulnerability in the vCenter Server can pose no less a threat than the infamous vulnerability in Citrix," noted Mikhail Klyuchnikov, the Positive Technologies researcher who unearthed this latest critical VMware flaw.

Positive Technologies have found over 6,000 vulnerable VMware vCenter devices accessible from the internet, a quarter of these which are located in the United States, followed by Germany, France, China, Great Britain, Canada, Russia, Taiwan, Iran, and Italy.

Several PoC exploit scripts have already popped up on GitHub, and Klyuchnikov followed with the release of additional technical details about the vulnerability, as well as the whole process of getting RCE on Windows and Linux.

Alongside CVE-2021-21972, VMware has also fixed CVE-2021-21973, a SSRF vulnerability in the vSphere Client also discovered by Klyuchnikov, and CVE-2021-21974, a heap-overflow vulnerability in ESXi, reported by Lucas Leong of Trend Micro's Zero Day Initiative.

News URL

http://feedproxy.google.com/~r/HelpNetSecurity/~3/b3zbSkdzmyc/