Code Injection in vCenter Server - CVE-2021-22014

Vulnerability identifier: #VU56803

CSH Severity: Low

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-22014

CWE-ID: CWE-94

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in VAMI (Virtual Appliance Management Infrastructure). A remote authenticated VAMI user can send a specially crafted request to port 5480/TCP and execute arbitrary code on the target system.

vCenter Server
Dell Enterprise Hybrid Cloud
EMC Integrated Data Protection Appliance
Cloud Foundation
Dell EMC VxRail Appliance

Install updates from vendor's website.

vCenter Server - addressed in versions 6.5 U3q, 6.7 U3o, 7.0 U2c
EMC Integrated Data Protection Appliance - update to 2.7.0
Cloud Foundation - update to 3.10.2.2
Dell Enterprise Hybrid Cloud - update to 4.1.2
Dell EMC VxRail Appliance - addressed in versions 4.5.463, 4.7.536, 7.0.241

• https://www.vmware.com/security/advisories/VMSA-2021-0020.html

• Multiple vulnerabilities in VMware vCenter Server
• Multiple vulnerabilities in VMware vCloud Foundation
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• Dell EMC Enterprise Hybrid Cloud update for VMware products
• Multiple vulnerabilities in Dell EMC PowerProtect DP Series (Integrated Data Protection Appliance)