Security Alert from G DATA: Vulnerability in VMware ESXi – patch urgently required!

February 6, 2023

A critical security vulnerability in VMware’s virtualisation platform is currently being actively exploited to attack server systems around the world. A patch for the two-year-old vulnerability is available and should be installed immediately.
Just in time for the weekend, the French CERT (CERT-FR), among others, reported a wave of attacks against systems running VMware ESXi versions 6.5.x, 6.7.x and 7.x (details on the VMware website). The explosive aspect is that the security vulnerability with the identifier CVE-2021-21974 has already been known and patched for two years. The attacks are therefore specifically directed against unpatched systems. The vulnerability has a criticality value of 9.8 – the highest possible number is 10. So it doesn’t get much more critical than that.

Immediate measures
On successfully attacked systems, the Nevada ransomware is installed, which, among other things, encrypts the virtual hard disks of guest systems (file extensions *vmdk, *vmx, *vmsd and others). “Anyone who has not yet installed the patches should take action here as soon as possible,” says Tim Berghoff, Security Evangelist at G DATA CyberDefense AG. “Encrypted systems sometimes cause outages, among others at an Italian telecommunications provider.”

To block attacks, at least for the time being, it is recommended to deactivate the SLP protocol on unpatched hypervisor systems. This requires the following commands in the shell:

Detailed information can be found in the VMware Knowledge Base.

“Even if there are no recognisable signs of an attack, it is worth looking for IoC (Indicators of Compromise),” advises Berghoff.

Legacy attacks take bitter revenge
This current wave of attacks shows once again how important it is to install patches. Even an old security hole can become a problem – sometimes only years later, as in this case. There are enough examples of this. One of the most famous examples, where home users were also affected, is WannaCry. The underlying vulnerability had already been known and patched for a quarter of a year at the time of the outbreak.

Related Articles

Smart Cities market predicted to top $1,100 billion by 2028

Smart Cities market predicted to top $1,100 billion by 2028

The adoption of smart cities has witnessed a remarkable surge in recent years, driven by advancements in technology, growing urbanisation, and increasing recognition of the benefits of smart solutions.  This market is, according to the latest research from...

One year of Cell Broadcast in Baden-Württemberg

One year of Cell Broadcast in Baden-Württemberg

Minister Thomas Strobl: "The last 12 months have shown that cell broadcasting enables us to reach a large number of people quickly and easily in an emergency" "In the event of imminent danger or damage, it is crucial that we warn the population and give people...

Share This