erroneo.us
Search all guides⌘K

Security Digest · Mar 29, 2022 · Vulnerability · Cloud

vCenter CVE-2022-22948: DB Credential Leak Used by UNC3886

A 2022 vCenter file-permission bug exposed database credentials and was later used by China-nexus UNC3886. Fixed in 7.0 U3d, 6.7 U3p, 6.5 U3r. Check builds.

Published By erroneo.us Security Desk · Updated 3 min read11 sources

Our verdict

Check exposure

Fixed since March 2022 and only useful to someone already on the appliance, but an espionage group used it to reach ESXi hosts; make sure no vCenter is still on an old 6.x or 7.0 build, and hunt if one was.

Who must act: Teams with any vCenter Server Appliance on 6.5, 6.7 or 7.0, patched or not, since those lines are out of general support and later vCenter bugs are also exploited.

Who can relax: Organizations without on-premises vCenter, and teams already on current 8.0 or 9.x builds whose older appliances were patched in 2022 and never showed signs of intrusion.

Affected
vCenter Server 7.0 before 7.0 U3d
vCenter Server Appliance 6.7 before 6.7 U3p
vCenter Server Appliance 6.5 before 6.5 U3r
VMware Cloud Foundation 4.x before 4.4.1 and 3.x before 3.11
Windows-based vCenter 6.5 and 6.7 are not affected
Fixed in
vCenter 7.0 U3d, 6.7 U3p and 6.5 U3r (Mar 29, 2022)
Cloud Foundation 4.4.1 and 3.11
Today: vCenter 8.0 U3k, 9.0.2.0100, 9.1.0.0300 or later, because of exploited CVE-2026-59310
CVSS
6.5 (v3.1, NVD)
EPSS
13.3% (percentile 96)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Medium

What to do

  1. Inventory every vCenter, including the ones inside Cloud Foundation, and record its build with vpxd -v on the appliance.
  2. Move any 6.5, 6.7 or 7.0 appliance to a supported 8.0 or 9.x release; those lines are past end of general support.
  3. Bring 8.0 and 9.x appliances to 8.0 U3k, 9.0.2.0100, 9.1.0.0300 or later.
  4. Limit appliance shell, SSH and management access to a small admin group on a management network.
  5. If an old appliance was reachable from untrusted networks, hunt as below and rotate vCenter, SSO and ESXi credentials.

How to check if you are affected or compromised

  • Review shell histories on the appliance for psql sessions against the VCDB database or queries on vc.vpx_host by anyone other than expected admins.
  • Search ESXi /var/log/auth.log for SSH logins as vpxuser, the step Pentera used to take over hosts, and explain each one.
  • Check Linux guests and ESXi hosts for the UNC3886 indicators in Mandiant's June 2024 report, such as backdoored /usr/bin/ssh and /usr/sbin/sshd.
  • Look for unknown vSphere SSO administrators or local ESXi accounts created since the appliance was last trusted.

What happened#

On March 29, 2022, VMware published VMSA-2022-0009 for CVE-2022-22948, an information disclosure bug caused by "improper permission of files" in vCenter Server. VMware said a malicious actor with non-administrative access to vCenter Server could read sensitive data. It rated the bug moderate, CVSS 5.5 with a local vector. NVD and CISA score it 6.5 with a network vector. There was no workaround.

Yuval Lazar of Pentera found it. Pentera's write-up shows the impact. The file /etc/vmware-vpx/vcdb.properties holds the plaintext password for vCenter's PostgreSQL database, and any member of the cis group could read it. That database stores an encrypted password for vpxuser, the account vCenter uses on every ESXi host it manages. The decryption key in symkey.dat needs root, so Pentera chained its earlier privilege escalation, CVE-2021-22015, to get it. It then logged in to ESXi over SSH as vpxuser. One low-privileged foothold on vCenter became control of the hypervisors.

The bug was in no known attacks when it was fixed, and Tenable reported no in-the-wild use at the time. That changed on June 18, 2024. In a report on UNC3886, a suspected China-nexus espionage group, Mandiant wrote that CVE-2022-22948 "was exploited to obtain encrypted credentials in the vCenter's postgresDB for further access." The same report says UNC3886 used CVE-2023-34048 for unauthenticated code execution on vCenter, and collected vpxuser credentials to reach guest VMs. On July 17, 2024, CISA added the CVE to its KEV catalog. CISA did not publish its evidence, but Mandiant's report a month earlier is the public record of exploitation.

Who is affected#

According to the CVE record and the advisory: vCenter 7.0 before 7.0 U3d, and the 6.7 and 6.5 virtual appliances before 6.7 U3p and 6.5 U3r. Cloud Foundation is fixed in 4.4.1 and 3.11. Windows-based vCenter 6.5 and 6.7 are not affected.

Do you really need to act?#

For this bug alone, most teams patched long ago, so the verdict is check exposure. The attacker needs a shell on the appliance first. UNC3886 is a capable actor that combined it with a remote vCenter bug. The real risk is old appliances. Broadcom ended general support for vCenter 6.5 and 6.7 on October 15, 2022, and for 7.0 on October 2, 2025, according to its lifecycle note. vCenter has had more exploited bugs since then. The newest is CVE-2026-59310, fixed in 8.0 U3k, 9.0.2.0100 and 9.1.0.0300. An appliance that is "patched for 2022-22948" can still be badly out of date.

What to do now#

  1. List every vCenter, including those inside Cloud Foundation, and run vpxd -v on each appliance to record the build.
  2. Upgrade any 6.5, 6.7 or 7.0 appliance to a supported 8.0 or 9.x release. Bring 8.0 and 9.x to the CVE-2026-59310 fixed builds or later.
  3. Restrict appliance shell, SSH and management access to a small admin group on a management network.
  4. If an old appliance was reachable from untrusted networks, run the checks below and rotate vCenter, SSO and ESXi credentials.

How to tell if you were hit#

  • Review appliance shell histories for psql sessions against the VCDB database, or queries on vc.vpx_host, that no admin can explain.
  • On ESXi hosts, run grep vpxuser /var/log/auth.log and investigate SSH logins as vpxuser. That was the final step in Pentera's chain.
  • Check Linux guests and ESXi hosts for the UNC3886 indicators in Mandiant's report, including backdoored /usr/bin/ssh and /usr/sbin/sshd.

Timeline#

  • — VMware publishes VMSA-2022-0009 and fixed builds; Pentera publishes its analysis.
  • — Advisory updated with the Cloud Foundation 4.4.1 fix.
  • — End of general support for vCenter 6.5 and 6.7.
  • — Mandiant reports UNC3886 exploited the bug.
  • — CISA adds CVE-2022-22948 to KEV; federal deadline Aug 7, 2024.
  • — End of general support for vCenter 7.0.

Vulnerability records

  • CVE-2022-22948 · KEV 2024-07-17 · The vCenter Server contains an information disclosure vulnerability due to improper permission of files.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. VMware — VMSA-2022-0009.1: vCenter Server updates address an information disclosure vulnerability (archived copy) web.archive.org
  2. Pentera — Mitigating VMware vCenter Information Disclosure (CVE-2022-22948) pentera.io
  3. CVE record — CVE-2022-22948 cve.org
  4. NVD — CVE-2022-22948 nvd.nist.gov
  5. CISA — Known Exploited Vulnerabilities: CVE-2022-22948 cisa.gov
  6. CISA — CISA Adds Three Known Exploited Vulnerabilities to Catalog (Jul 17, 2024) cisa.gov
  7. Mandiant (Google Cloud) — Cloaked and Covert: Uncovering UNC3886 Espionage Operations cloud.google.com
  8. Broadcom — End of General Support for vSphere 6.5/6.7/7.0 knowledge.broadcom.com
  9. CVE record — CVE-2023-34048 cve.org
  10. CVE record — CVE-2026-59310 cve.org
  11. Tenable — CVE-2022-22948: VMware vCenter Server Sensitive Information Disclosure Vulnerability tenable.com