Leading virtualization and cloud computing giant, VMware, has released its latest series of security patches.<\/p>\n
This fleet of patches is particularly significant due to the addressing of a potent vulnerability that was previously flagged by the North Atlantic Treaty Organization (NATO).<\/p>\n
Labeled CVE-2021-21972, the vulnerability lays within the vCenter Server plugin for the vSphere Client.<\/p>\n
An unauthorized user may send a specifically drafted HTTP request to exploit this flaw, potentially leading to remote code execution.<\/p>\n
As implied from its Common Vulnerability Scoring System (CVSS) of 9.8 out of 10, this vulnerability poses critical security risks that need to be addressed with urgency.<\/p>\n
The exploitation of this vulnerability can pose serious threats facilitating data leakage, command execution, and denial-of-service attacks.<\/p>\n
The attack can be launched from within the network, potentially compromising sensitive data stored on the server.<\/p>\n
Despite the complexity of orchestrating a successful exploit, seasoned cyber criminals could feasibly hop onto the server and maneuver around the system with unprecedented access.<\/p>\n
VMware’s patch update aimed at rectifying this flaw comes in the versions of 7.0 U1c, 6.7 U3l, and 6.5 U3n.<\/p>\n
As of now, VMware has not provided any temporary workaround or mitigation measure besides updating to the latest patched versions.<\/p>\n
Organizations using the affected versions are strongly recommended to apply these patches without delay.<\/p>\n
A citation of a real-world example of this type of attack can be drawn from the recent SolarWinds hack.<\/p>\n
Establishing a foothold through unpatched software, attackers managed to gain extensive access over the victim’s network, demonstrating the catastrophic aftermath of such exploits.<\/p>\n
The repercussions of neglecting such patches can be far-reaching and devastating for not just the affected organization, but also its client base and industry at large.<\/p>\n
The risk of national security implications highlights the importance of timely patching and maintaining an updated security infrastructure.<\/p>\n