{"uuid": "cdd85089-a549-4059-a38e-9caf3f6ca417", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22005", "type": "exploited", "source": "https://t.me/hacking_Attack/37773", "content": "of VMware Cloud Foundation. Patch information can be found in the vendor\u2019s advisory.\n\nUsers should patch as soon as possible, given that VMware is a favorite target for cybercriminals. For instance, just days after a critical CVE-2021-22005 RCE vulnerability in VMware vCenter was disclosed, a full working exploit was public and being used\u00a0in the wild.\n\nESXi users are especially at risk: While the solution makes it easy for multiple VMs to share the same hard-drive storage, it also sets systems up to be one-stop shopping spots for attacks, researchers say, since attackers can target the centralized virtual hard drives used to store data from across VMs.\n\n\u201cESXi servers represent an attractive target for ransomware threat actors because they can attack multiple VMs at once, where each of the VMs could be running business-critical applications or services,\u201d Andrew Brandt, principal researcher at Sophos, recently explained. \u201cAttacks on hypervisors can be both fast and highly disruptive.\u201d\n\nHe was discussing a spate of attacks in October that used a Python code that took less than three hours to complete a ransomware attack on ESXi servers, from initial breach to encryption. That incident joined other ransomware efforts targeting the hypervisor: REvil ransomware threat actors last year came up with a Linux variant\u00a0that targeted VMware ESXi; and in September HelloKitty joined\u00a0the growing list going after the juicy target. DarkSide also targeted\u00a0ESXi servers last year.\nSee Also: Offensive Security Tool: Spray365 Workaround for ESXi v.7 UsersOf course, all of that is bad news for ESXi v.7 users, who don\u2019t yet have a patch for this latest bug. VMware did, however, issue a workaround\u00a0that can be used for now, involving disabling CD-ROM/DVD functionality.\n\nThe steps are:\n\n1. Log in to a\u00a0vCenter Server\u00a0system using the\u00a0vSphere Web Client.\n2. Right-click the virtual machine and click\u00a0Edit Settings.\n3. Select the CD/DVD drive and uncheck \u201cConnected\u201d and \u201cConnect at power on\u201d and remove any attached ISOs.\nSee Also: Hacking stories \u2013 Rafael N\u00fa\u00f1ez (aka RaFa), hacking NASA with the hacking group: World of Hell\nTo enumerate the VMs that have a CD-ROM/DVD device attached, users can run the following command, according to the vendor:\n\nGet-VM | Get-CDDrive | Where {$_.extensiondata.connectable.connected -eq $true} | Select Parent\n\nThen the following command will remove and disconnect the attached CD-ROM/DVD device:\n\nGet-VM | Get-CDDrive | Where {$_.extensiondata.connectable.connected -eq $true} | Set-CDDrive -NoMedia -confirm:$false\nSource: threatpost.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/Apple-iPhone-13-Pro-90x90.png iOS malware can fake iPhone shut downs to snoop on camera, microphone1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/0358ad020c37-article-cache-poisoning-article-90x90.png Researcher discovers 70 web cache poisoning vulnerabilities, nets $40k in bug bounty rewards2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/1200x0-90x90.jpg Apple iOS vulnerable to HomeKit \u2018doorLock\u2019 denial of service bug3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/exchange-90x90.png Microsoft releases emergency fix for Exchange \u2013 2022 bug4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/maxresdefault-90x90.jpg Have I Been Pwned adds 441K accounts stolen by RedLine malware1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/1229111902.0-90x90.jpg T-Mobile says new data breach caused by SIM swap attacks1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/feature-log4j-blue-90x90.png Log4j 2.17.1 out now, fixes new remote code execution bug1 week ag[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T16:00:05.548284Z"}