Wednesday , February 19 2025

VMware fixes critical vulnerability in vRealize network analytics tool

VMware issued multiple security patches today to address critical and high-severity vulnerabilities in VMware Aria Operations for Networks, allowing attackers to gain remote execution or access sensitive information.

Previously known as vRealize Network Insight (vRNI), this network visibility and analytics tool helps admins optimize network performance or manage and scale various VMware and Kubernetes deployments.

150 Gov.t Portal affected
Black-Hat SEO Poisoning Indian “.gov.in, .ac.in” domain

Indian government and educational websites, along with reputable financial brands, have experienced SEO poisoning, causing user traffic to be redirected...
Read More
150 Gov.t Portal affected  Black-Hat SEO Poisoning Indian “.gov.in, .ac.in” domain

CVE-2018-19410 Exposes 600 PRTG Instances in Bangladesh

The Cyber Threat Intelligence Unit of BGD e-GOV CIRT has found 600 vulnerable PRTG instances in Bangladesh, affected by the...
Read More
CVE-2018-19410 Exposes 600 PRTG Instances in Bangladesh

Builder claims Rs 150 cr for data loss; AWS faces FIR In Bengaluru

Amazon Web Services (AWS) has been named in an FIR after a builder claimed damages to the tune of Rs...
Read More
Builder claims Rs 150 cr for data loss;  AWS faces FIR In Bengaluru

CISA Warns Active Exploitation of Apple iOS Security Flaw

CISA has issued an urgent warning about a critical zero-day vulnerability in Apple iOS and iPadOS, known as CVE-2025-24200, which...
Read More
CISA Warns Active Exploitation of Apple iOS Security Flaw

Massive IoT Data Breach Exposes 2.7 Billion Records

A major IoT data breach has exposed 2.7 billion records, including Wi-Fi network names, passwords, IP addresses, and device IDs....
Read More
Massive IoT Data Breach Exposes 2.7 Billion Records

SonicWall Firewall Auth Bypass Vulnerability Exploited in Wild

A serious authentication bypass vulnerability in SonicWall firewalls, called CVE-2024-53704, is currently being exploited, according to cybersecurity firms. The increase...
Read More
SonicWall Firewall Auth Bypass Vulnerability Exploited in Wild

AMD Patches High-Severity SMM Vulns Affecting EPYC and Ryzen Processors

AMD has released security patches for two high-severity vulnerabilities in its System Management Mode (SMM). If exploited, these could let...
Read More
AMD Patches High-Severity SMM Vulns Affecting EPYC and Ryzen Processors

Lazarus Group Unleashes New Malware Against Developers Worldwide

Lazarus Group has initiated a complex global campaign aimed at software developers and cryptocurrency users. Operation Marstech Mayhem uses the...
Read More
Lazarus Group Unleashes New Malware Against Developers Worldwide

Daily Security Update Dated : 15.02.2025

Every day a lot of cyberattack happen around the world including ransomware, Malware attack, data breaches, website defacement and so...
Read More
Daily Security Update Dated : 15.02.2025

Salt Typhoon to target Bangladeshi Universities, One identified

RedMike (Salt Typhoon) targeted university devices in Bangladesh, likely to access research in telecommunications, engineering, and technology, especially from institutions...
Read More
Salt Typhoon to target Bangladeshi Universities, One identified

The most severe of the three security bugs fixed today is a command injection vulnerability tracked as CVE-2023-20887, which unauthenticated threat actors can exploit in low-complexity attacks that don’t require user interaction.

ALSO READ:

After Microsoft outlook, Hacker group next target Chat GPT, who are behind?

“A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution,” Vmware says.

VMware patched today a second vulnerability that could lead to remote code execution on unpatched Aria Operations appliances, caused by an authenticated deserialization weakness tracked as CVE-2023-20888.

Just like CVE-2023-20887, this also requires network access to the vulnerable appliance and valid ‘member’ role credentials for a successful deserialization attack leading to remote code execution.

The third flaw, an information disclosure vulnerability tracked as CVE-2023-20889, enables malicious actors to access sensitive information following a successful command injection attack.

No workarounds available

WMware says no workarounds are available to remove the attack vector, so admins must patch all VMware Aria Operations Networks 6.x on-prem installations to secure them against attacks.

You can find the complete list of security patches released to address these flaws for all vulnerable Aria Operations for Networks versions on VMware’s Customer Connect website.

On the same page, the company has shared details steps on the procedure required to apply the patch bundles, which requires downloading the update patch file, uploading it while being logged as the Administrator user in the vRNI GUI, and installing it from Settings > Install and Support > Overview and Updates.

In April, VMware also addressed a critical bug that let attackers run code as root in the vRealize Log Insight log analysis tool.

Months earlier, Horizon3’s Attack Team released proof-of-concept exploit code for another series of critical security flaws in the same VMware product patched one week earlier.

Source: Bleeping computer

Check Also

CYFIRMA

FinStealer Malware Targets Indian Bank’s Mobile Users, Stealing Credentials

CYFIRMA analysis reveals a sophisticated malware campaign that exploits a major Indian bank’s brand through …

Leave a Reply

Your email address will not be published. Required fields are marked *