Vulnerability identifier: #VU56504

Vulnerability risk: High

CVSSv3.1: 9.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2021-38647

CWE-ID: CWE-94

Exploitation vector: Network

Exploits in database: 11

• October 28, 2021
  • Microsoft OMI Management Interface Authentication Bypass [Metasploit]
• September 28, 2021
  • omigod (Quick and dirty CVE-2021-38647 (Omigod) exploit written in Go.) [Github]
• September 25, 2021
  • OMIGOD_cve-2021-38647 (CVE-2021-38647 is an unauthenticated RCE vulnerability effecting the OMI agent as root.) [Github]
• September 22, 2021
  • CVE-2021-38647 (OMIGOD PoC) [Github]
  • CVE-2021-38647 (CVE-2021-38647 AKA "OMIGOD" vulnerability in Windows OMI ) [Github]
  • CVE-2021-38647 (CVE-2021-38647 - POC to exploit unauthenticated RCE #OMIGOD) [Github]
• September 21, 2021
  • omigood (OMIGOD! OM I GOOD? A free scanner to detect VMs vulnerable to one of the "OMIGOD" vulnerabilities discovered by Wiz's threat research team, specifically CVE-2021-38647.) [Github]
• September 19, 2021
  • CVE-2021-38647-POC-and-Demo-environment (OMIGod / CVE-2021-38647 POC and Demo environment) [Github]
• September 16, 2021
  • CVE-2021-38647 (CVE-2021-38647 POC for RCE) [Github]
  • cve-2021-38647 (A PoC exploit for CVE-2021-38647 RCE in OMI) [Github]
  • CVE-2021-38647 (Proof on Concept Exploit for CVE-2021-38647 (OMIGOD)) [Github]

Impact: Code execution

Vulnerable software:
Azure Open Management Infrastructure
Other software / Other software solutions

Vendor: Microsoft