Pentera Labs Webinar: VMware vCenter CVE-2022-22948

This webinar presents detailed research into a vulnerability chain discovered in VMware vCenter that could ultimately lead to full ESXi takeover. The session explains VMware’s architecture, where ESXi acts as the hypervisor hosting virtual machines and vCenter Server manages the environment centrally. The researchers uncovered that an out-of-the-box vCenter installation exposed a file containing cleartext database credentials, which provided visibility into ESXi inventory data and revealed an internal ESXi management account along with its encrypted password.

Although the password was encrypted, a separate privilege escalation vulnerability allowed retrieval of the encryption key, enabling decryption of the ESXi management credentials. This chain could grant full administrative control over ESXi, potentially enabling ransomware deployment, data exfiltration, or manipulation of security controls. The session emphasizes prioritizing vulnerabilities based on exploit chains and business impact rather than severity scores alone, and concludes with disclosure details, mitigation guidance, and lessons for risk-based validation.