PT-2023-3036 · Vmware · Vmware Aria Operations For Networks

Published 2023-06-07 · Updated 2025-07-09 · CVE-2023-20887

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VMware Aria Operations for Networks versions (affected versions not specified)

Description The issue is related to a command injection vulnerability in VMware Aria Operations for Networks. This vulnerability can be exploited by a malicious actor with network access, potentially allowing them to perform a command injection attack and resulting in remote code execution. The vulnerability is being actively exploited in the wild.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2023-03101

CVE-2023-20887

ZDI-23-840

Affected Products

Vmware Aria Operations For Networks

References · 43

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/vmware_vrni_rce_cve_2023_20887.rb · Exploit
• 🔥 https://github.com/sinsinology/CVE-2023-20887 · Exploit
• 🔥 https://github.com/Malwareman007/CVE-2023-20887 · Exploit
• 🔥 https://github.com/miko550/CVE-2023-20887 · Exploit
• 🔥 http://packetstormsecurity.com/files/173761/VMWare-Aria-Operations-For-Networks-Remote-Command-Execution.html · Exploit
• https://osv.dev/vulnerability/CVE-2023-20887 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-20887 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-840 · Security Note
• https://bdu.fstec.ru/vul/2023-03101 · Security Note
• https://twitter.com/blackstormsecbr/status/1688960143285792778 · Twitter Post
• https://twitter.com/clovernetics/status/1707727400014913806 · Twitter Post
• https://t.me/ckure/12543 · Telegram Post
• https://t.me/ptswarm/177 · Telegram Post
• https://t.me/breachdetector/286962 · Telegram Post
• https://t.me/isacarusec/6691 · Telegram Post