CrowdSec
6/10CrowdSec Score

VMware View Planner - RCE (CVE-2021-21978)

Published on03-03-2021
First seen on31-07-2025

97Exploiting IPs reported

VMware View Planner 4.x prior to 4.6 Security Patch 1 contains a remote code execution vulnerability. Improper input validation and lack of authorization leading to arbitrary file upload in logupload web application. An unauthorized attacker with network access to View Planner Harness could upload and execute a specially crafted file leading to remote code execution within the logupload container.

CrowdSec analysis

CVE-2021-21978 is a critical remote code execution vulnerability due to improper input validation and missing authorization in the logupload web application. Attackers with network access can exploit this flaw to upload and execute arbitrary files, potentially gaining full control over the affected container. This vulnerability could be leveraged for further lateral movement, data theft, or disruption of services within the targeted environment.

CrowdSec has been tracking this vulnerability and its exploits since 10th of July 2025.

CrowdSec network observations suggest that most exploitation of CVE-2021-21978 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. In addition, according to the CrowdSec network, attack volume against CVE-2021-21978 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit the /logupload endpoint of VMware View Planner by sending a POST request with a crafted logMetaData parameter containing path traversal sequences, enabling arbitrary file upload and potential remote code execution.

Exploitation

Get real-time information about exploitation attempts and actors involved.

Detected IPs

Discover the IPs that targeted this vulnerability across the CrowdSec Network.

Protection

Find out relevant information to protect your stack against this CVE.

Blocklist

With our advanced worldwide network detection, CrowdSec can provide a list of IPs known for exploiting the vulnerability.

To increase your protection against this CVE, block exploitation attempts with this list of identified actors.