CVE-2021-21973 and CVE-2017-6077 Vulnerabilities

What is CVE-2021-21973?

VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability

Due to poor URL validation in a vCenter Server plugin, the vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability.

An actor with network access to port 443 might take advantage of this flaw by sending a POST request to vCenter Server plugin, exposing information. This type of vulnerability, also known as SSRF (Server-Side Request Forgery), is a web security flaw that allows an actor to force a server-side application (in this example, vSphere Client) to send HTTP requests to any arbitrary domain. An attacker can gain access to information inside the vulnerable application or other back-end systems to which the application has access if the attack is successful. It may allow the attacker to execute arbitrary code depending on the victim's rights.

VMware vCenter Server (6.5 before 6.5 U3n, 6.7 before 6.7 U3l, and 7. x before 7.0 U1c) and VMware Cloud Foundation (3. x before 3.10.1.2 and 4. x before 4.2) are affected.

Impact

An actor with network access to port 443 can run unlimited commands on the server that hosts the vCenter Server. This is a serious flaw that can potentially compromise the entire system and the network where vCenter is housed and the organization itself.

End-to-End Proactive Solutions for empowering Advanced Threat Protection and Intelligence with Real-Time Analytics, Cyber Security Services

What is CVE-2017-6077?

NETGEAR DGN2200 Remote Code Execution Vulnerability

CVE-2017-6077 allows an attacker to gain control of the modem router and issue commands.
This vulnerability can arise as a result of one or more of the following circumstances:

• A threat actor gained access to the internal network has discovered the administrator password for the router.
• On the modem router, remote management is enabled, and the administrator password is set to the default setting.

Remote authenticated users can execute arbitrary OS operations through shell metacharacters in the ping IPAddr field of an HTTP POST request using ping.cgi on NETGEAR DGN2200 devices with firmware up to 10.0.0.50. The vulnerability was treated as a non-public zero-day exploit for at least three days. It is claimed that exploitability is simple. It is feasible to carry out the attack from afar. Exploitation necessitates authentication. Technical information, as well as a public exploit, are available. The underground price was thought to be between $5k to $25k at the time. With plugin 13168 (NETGEAR DGN2200v1-'Multiple Vulnerabilities), the commercial vulnerability scanner Qualys can test this issue.

Impact

There is total information leakage, culminating in the revelation of all system files. Complete compromise of integrity. Complete loss of system protection results in the complete system being compromised. The impacted resource has been completely shut down.
The attacker has the ability to make the resource utterly unusable.

Conclusion

CVE-2021-21973 and CVE-2017-6077 are critical vulnerabilities with the capabilities to compromise your entire system by executing arbitrary code in your system. Metasecure monitors the latest Vulnerabilities and ensure complete protection to the Clients

Explore the Recently Discovered Critical Vulnerabilities and their Remediations