VMware vCenter Server Vulnerability

VMware vCenter is a server management software that is “centrally visible, simplified and efficient management at scale, and extensibility across the hybrid cloud – all from a single console” [5]. With the large-scale capability of running 2,000 hosts and 35,000 virtual environments from a centralized location, coupled with the ability to scale up to 5,000 hosts and 70,000 virtual environments, VMware vCenter offers solutions for server management that is desirable to organizations like Raytheon, Northrop Grumman, ECS Federal, and BAE Systems.

On September 21, 2021, VMware issued an advisory for its vCenter Server versions 6.5, 6.7, 7.0, and its vCloud Foundation versions 3.x and 4.x, stating that 19 vulnerabilities were discovered. These vulnerabilities ranged from privilege escalation and denial of service to information disclosure and path traversal [3][4]. Of the 19 vulnerabilities, nine (9) were listed as “Moderate,” nine (9) were listed as “Important,” and one (1) was listed as “Critical” [3]. The “Critical” vulnerability is CVE-2021-22005 with a common vulnerability score system (CVSS) of 9.8 [2].

On September 24, 2021, VMware confirmed reported that CVE-2021-22005 is being exploited in the wild. Security researchers are also reporting mass scanning for vulnerable vCenter Servers and publicly available exploit code. Due to the availability of exploit code, Cybersecurity and Infrastructure Security Agency (CISA) expects widespread exploitation of this vulnerability [1].