CRITICAL🚩 CISA KEV⚡ EXPLOIT🇵🇱 Wersja polska

CVE-2023-20887

CVSS 9.8v3.1pub. 2023-06-07upd. 2025-10-28

Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • VMware Aria Operations For Networks

    APP
    Vmware
    6.2.0 – 6.10.0

CISA KEV — detailsi

Vendori
VMware ↗
Producti
Aria Operations for Networks
Added to KEVi
June 22, 2023
Remediation deadline (US Federal)i
July 13, 2023(overdue)
Required action (CISA)i

Apply updates per vendor instructions.

CISA descriptioni

VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection vulnerability that allows a malicious actor with network access to perform an attack resulting in remote code execution.

🔴
IMMEDIATE ACTION
Actively exploited in the wild (CISA KEV). Patch immediately.
⏰CISA DEADLINE: 13 lipca 2023
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2023-34039CRITICAL9.8PL ✓same product

VMware Aria Operations for Networks — pominięcie uwierzytelniania SSH

CVE-2024-22237HIGH7.8same product

Aria Operations for Networks contains a local privilege escalation vulnerability. A console user with access t...

CVE-2023-20890HIGH7.2same product

Aria Operations for Networks contains an arbitrary file write vulnerability. An authenticated malicious actor ...

CVE-2024-22241MEDIUM4.3same product

Aria Operations for Networks contains a cross site scripting vulnerability. A malicious actor with admin privi...

CVE-2024-22238MEDIUM6.4same product

Aria Operations for Networks contains a cross site scripting vulnerability. A malicious actor with admin privi...