Actively exploited · Published Jun 7, 2023 · Assigned by vmware
CVE-2023-20887
Critical 9.8 Exploited
In plain English
A critical-severity command injection in Aria Operations for Networks (Formerly vRealize Network Insight). Attackers are actively exploiting it in the wild (listed by CISA on June 22, 2023). The chance it is exploited in the next 30 days is estimated at 98.3% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Jul 13, 2023.
Official description
Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Aria Operations for Networks (Formerly vRealize Network Insight) | Aria Operations for Networks (Formerly vRealize Network Insight) 6.x |
Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H