Security News > 2023 > August > VMware Aria vulnerable to critical SSH authentication bypass flaw

VMware Aria Operations for Networks is vulnerable to a critical severity authentication bypass flaw that could allow remote attackers to bypass SSH authentication and access private endpoints.

VMware Aria is a suite for managing and monitoring virtualized environments and hybrid clouds, enabling IT automation, log management, analytics generation, network visibility, security and capacity planning, and full-scope operations management.

Yesterday, the vendor published a security advisory warning of a flaw that impacts all Aria 6.x branch versions.

"Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation," warns VMware's advisory regarding the flaw.

"A malicious actor with network access to Aria Operations for Networks could bypass SSH authentication to gain access to the Aria Operations for Networks CLI.".

In June 2023, VMware warned its clients about the active exploitation of CVE-2023-20887, a remote code execution vulnerability impacting Aria Operations for Networks.

News URL

https://www.bleepingcomputer.com/news/security/vmware-aria-vulnerable-to-critical-ssh-authentication-bypass-flaw/