vCenter CVE-2022-22948: DB Credential Leak Used by UNC3886
Fixed since March 2022 and only useful to someone already on the appliance, but an espionage group used it to reach ESXi hosts; make sure no vCenter is still on an old 6.x or 7.0 build, and hunt if one was.
Must act: Teams with any vCenter Server Appliance on 6.5, 6.7 or 7.0, patched or not, since those lines are out of general support and later vCenter bugs are also exploited.
Can relax: Organizations without on-premises vCenter, and teams already on current 8.0 or 9.x builds whose older appliances were patched in 2022 and never showed signs of intrusion.
- Inventory every vCenter, including the ones inside Cloud Foundation, and record its build with vpxd -v on the appliance.
- Move any 6.5, 6.7 or 7.0 appliance to a supported 8.0 or 9.x release; those lines are past end of general support.
- Bring 8.0 and 9.x appliances to 8.0 U3k, 9.0.2.0100, 9.1.0.0300 or later.