notification_important Alert

VMware vCenter Server plugin remote code execution vulnerability (CVE-2021-21972)

Alert on a critical VMware vCenter Server vulnerability. ASD’s ACSC urges organisations to patch affected systems promptly to prevent remote code execution.

error
Alert Status: High
Published
Last reviewed
|

If successfully exploited, CVE-2021-21972 would allow an adversary with access to port 443 to remotely execute commands with unrestricted privileges on the underlying operating system hosting VMware vCenter Server. VMware evaluates the severity of this issue to be Critical in their severity range. Proof of concept code to exploit the vulnerability has been published online.

The Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) strongly encourages users and administrators to review the VMware advisory for CVE-2021-21972 (VMSA-2021-0002) and update their systems promptly. The ASD's ACSC recommends that enterprises should restrict the exposure of management interfaces internally and externally to their enterprise.

Further information about CVE-2021-21972 is available on VMware’s website.

Was this helpful?
Yes this was helpful
No this was not helpful

Thanks for your feedback!

We welcome additional feedback below.

How easy was it to find information?
How easy was it to understand this information?
After reading this, how confident are you that you know what to do next?
Overall, how satisfied were you with your experience on this website today?
vertical_align_top Back to top