Last updated on August 15, 2021
Cyber Security Alert
TCSA : 20210528-1-1-P
A Critical Security Flaw Found on all VMware vCenter Servers
A critical remote code execution bug was found in VMware vCenter Server 6.5, 6.7, and 7.0, according to VMware’s security advisory. The vulnerability rated with a CVSSv3 base score of 9.8 out of 10 is being tracked as CVE-2021-21985.
The issue exists on the vSphere Client (HTML5) of Virtual SAN Health Check plug-in which is enabled by default in all vCenter Server deployments, whether or not vSAN is being used. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
VMware further stated that in this era of ransomware, it is safest to assume that an attacker is already inside the network somewhere, on a desktop, and perhaps even in control of a user account, which is why VMware strongly recommends declaring an emergency change and patching as soon as possible.
Affected Versions
- vCenter Server 6.5
- vCenter Server 6.7
- vCenter Server 7.0
- Cloud Foundation (vCenter Server) 4.x
- Cloud Foundation (vCenter Server) 3.x
Mitigation
Apply the security updates or apply the workaround described in VMSA-2021-0010.
More Information
VMSA-2021-0010 – https://www.vmware.com/security/advisories/VMSA-2021-0010.html
CVE-2021-21985 – https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21985
Disclaimer: The information you have accessed or received is provided “as is” for informational purposes only. TechCERT does not provide any warranties of any kind regarding this information.
Citation: TechCERT Cyber Security Alerts