Threat Brief: VMware Command Injection Vulnerability (CVE-2020-4006)
Summary: On Dec. 7, 2020, the NSA published an advisory saying it observed Russian state-sponsored actors exploiting a VMware command injection vulnerability, CVE-2020-4006, which VMware patched on Dec. 3, 2020. Exploitation requires network access to the administrative configurator on port 8443 (configurable to any port) and a valid password for the configurator admin account, after which an actor could execute commands with unrestricted privileges on the underlying operating system.
Why it matters: Russian state-sponsored actors were already exploiting this flaw when the NSA disclosed it, and the only barrier was a valid admin password on an internet-reachable configurator port. Unit 42 said it lacked specific attack details and had not yet identified a proof of concept, so detection coverage was not guaranteed at the time.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2020-4006
- Related
- CVE-2020-4006: Multiple VMware Products Command Injection Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021VMware Flaw a Vector in Solar Winds Breach? Cyber Risks ·Threat Advisory: NSA SVR Advisory Coverage Cyber Risks ·