CVE-2017-4914

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x contains a deserialization issue. Exploitation of this issue may allow a remote attacker to execute commands on the appliance.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
VMware	vSphere Data Protection (VDP)	6.1.x; 6.0.x; 5.8.x; 5.5.x

References

http://www.securityfocus.com/bid/98939Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038617
http://www.vmware.com/security/advisories/VMSA-2017-0010.htmlPatch, Vendor Advisory
https://www.exploit-db.com/exploits/42152/
http://www.securityfocus.com/bid/98939Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038617
http://www.vmware.com/security/advisories/VMSA-2017-0010.htmlPatch, Vendor Advisory
https://www.exploit-db.com/exploits/42152/

Timeline

Published: Jun 7, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-49157.8VMware Workstation Pro/Player contains an insecure library loading vulnerability via ALSA sound driver configuration files. Successful explo CVE-2017-49166.5VMware Workstation Pro/Player contains a NULL pointer dereference vulnerability that exists in the vstor2 driver. Successful exploitation of CVE-2017-49179.8VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x locally stores vCenter Server credentials using reversible encryption. T CVE-2017-49189.8VMware Horizon View Client (2.x, 3.x and 4.x prior to 4.5.0) contains a command injection vulnerability in the service startup script. Succe CVE-2017-49199.0VMware vCenter Server 5.5, 6.0, 6.5 allows vSphere users with certain, limited vSphere privileges to use the VIX API to access Guest Operati CVE-2017-49205.9The implementation of the OSPF protocol in VMware NSX-V Edge 6.2.x prior to 6.2.8 and NSX-V Edge 6.3.x prior to 6.3.3 doesn't correctly hand CVE-2017-49218.8VMware vCenter Server (6.5 prior to 6.5 U1) contains an insecure library loading issue that occurs due to the use of LD_LIBRARY_PATH variabl CVE-2017-49226.5VMware vCenter Server (6.5 prior to 6.5 U1) contains an information disclosure issue due to the service startup script using world writable CVE-2017-49239.8VMware vCenter Server (6.5 prior to 6.5 U1) contains an information disclosure vulnerability. This issue may allow plaintext credentials to CVE-2017-49248.8VMware ESXi (ESXi 6.5 without patch ESXi650-201707101-SG), Workstation (12.x before 12.5.7) and Fusion (8.x before 8.5.8) contain an out-of-CVE-2017-49255.5VMware ESXi 6.5 without patch ESXi650-201707101-SG, ESXi 6.0 without patch ESXi600-201706101-SG, ESXi 5.5 without patch ESXi550-201709101-SG CVE-2017-49265.4VMware vCenter Server (6.5 prior to 6.5 U1) contains a vulnerability that may allow for stored cross-site scripting (XSS). An attacker with