CVE-2023-20867

LOW KEV RANSOMWARE

VMware Tools 10.3.0-12.2.5 - Improper Authentication

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2023-20867 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added June 23, 2023, with confirmed use in ransomware campaigns.

Description

A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.

References (10)

Core 10
Core References
Mailing List, Third Party Advisory
https://www.debian.org/security/2023/dsa-5493

Scores

CVSS v3 3.9
EPSS 0.0219
EPSS Percentile 84.8%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact partial

Details

CISA KEV 2023-06-23
VulnCheck KEV 2023-06-13
InTheWild.io 2023-06-23
ENISA EUVD EUVD-2023-25040
Ransomware Use Confirmed
CWE
CWE-287
Status published
Products (7)
debian/debian_linux 10.0
debian/debian_linux 11.0
debian/debian_linux 12.0
fedoraproject/fedora 37
fedoraproject/fedora 38
fedoraproject/fedora 39
vmware/tools 10.3.0 - 12.2.5
Published Jun 13, 2023
KEV Added Jun 23, 2023
Tracked Since Feb 18, 2026