Hackers have begun scanning for vulnerable VMware vCenter servers
In a not entirely unexpected development, threat actors have started looking for internet-exposed VMware vCenter servers whose admins haven’t yet patched them against the critical arbitrary file upload vulnerability that was disclosed yesterday.
The critical security flaw, tracked as CVE-2021-22005 impacts VMware’s flagship vCenter Server deployments, and could help facilitate remote code execution (RCE) attacks from unauthenticated attackers without requiring user interaction.
“In this era of ransomware it is safest to assume that an attacker is already inside your network somewhere, on a desktop and perhaps even in control of a user account, which is why we strongly recommend declaring an emergency change and patching as soon as possible," warned Bob Plankers, Technical Marketing Architect at VMware yesterday as he urged vCenter Server admins to apply the patches without delay.
