cbcvebase.
CVE-2021-21972
published 2021-02-24

CVE-2021-21972: The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may…

PriorityP1100critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITRansomwareInitial access
CISA Known Exploited Vulnerabilitydue 2021-11-17
Exploited in the wild
EPSS
99.52%
99.9th percentile
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).

Affected

5 ranges
VendorProductVersion rangeFixed in
vmwarecloud_foundation>= 3.0 < 3.10.1.23.10.1.2
vmwarecloud_foundation>= 4.0 < 4.24.2
vmwarevcenter_server
vmwarevcenter_server
vmwarevcenter_server

Detection & IOCsextracted from sources · hover to see the quote

port443
  • Detect FaceFish backdoor activity by monitoring for creation of libs.so and modification of /etc/ld.so.preload, followed by an sshd service restart — the classic ld.so.preload injection pattern.
  • Alert on inbound HTTPS (port 443) connections to vCenter Server from unexpected external IP addresses, as CVE-2021-21972 is exploitable over port 443 without authentication.
  • Detect mass event log clearing via wevtutil as a defense evasion indicator following vCenter compromise; specifically look for the PowerShell pipeline pattern iterating over all log channels.
  • Flag execution of intel.exe from SYSVOL scripts directory (C:\Windows\SYSVOL_DFSR\domain\scripts\intel.exe) as a high-confidence indicator of malicious masquerading within domain infrastructure.
  • ·CVE-2021-21972 affects VMware vCenter Server 7.x before 7.0 U1c, 6.7 before 6.7 U3l, and 6.5 before 6.5 U3n, as well as VMware Cloud Foundation 4.x before 4.2 and 3.x before 3.10.1.2. Detection and patching scope should cover all these version ranges.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck9.8CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.