« Volver al listado

CVE-2021-38647

Estado: AnalizadaCrítica (9.8)⚠ Explotación activa

Open Management Infrastructure (OMI) Remote Code Execution Vulnerability

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

CISA KEV — explotada activamente

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

OMI RCE remota sin autenticación (AV:N/PR:N/UI:N) permite ejecución remota de código en infraestructura Azure. Usado activamente en ransomware.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementFilter Network TrafficVulnerability ScanningNetwork SegmentationLimit Access to Resource Over NetworkExecution Prevention

Tecnologías afectadas (10)

Microsoft — Azure Automation State ConfigurationMicrosoft — Azure Automation Update ManagementMicrosoft — Azure Diagnostics (lad)Microsoft — Azure Security CenterMicrosoft — Azure SentinelMicrosoft — Azure Stack HUBMicrosoft — Container Monitoring SolutionMicrosoft — LOG Analytics AgentMicrosoft — Open Management InfrastructureMicrosoft — System Center Operations Manager

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-38647",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2021-38647",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-04T14:45:47.017000Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secure@microsoft.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Secondary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "Microsoft",
          "product": "Azure Automation State Configuration, DSC Extension",
          "versions": [
            {
              "status": "affected",
              "version": "2.0.0",
              "lessThan": "DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Azure Automation Update Management",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0",
              "lessThan": "OMS Agent for Linux GA v1.13.40-0",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Azure Diagnostics (LAD)",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0",
              "lessThan": "LAD v4.0.13 and LAD v3.0.135",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Azure Security Center",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0",
              "lessThan": "OMS Agent for Linux GA v1.13.40-0",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Azure Sentinel",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0",
              "lessThan": "OMS Agent for Linux GA v1.13.40-0",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Azure Stack Hub",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0",
              "lessThan": "Monitor, Update and Config Mgmnt 1.14.01",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Container Monitoring Solution",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0",
              "lessThan": "publication",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Log Analytics Agent",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0",
              "lessThan": "OMS Agent for Linux GA v1.13.40-0",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Open Management Infrastructure",
          "versions": [
            {
              "status": "affected",
              "version": "16.0",
              "lessThan": "OMI Version 1.6.8-1",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "System Center Operations Manager (SCOM)",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0",
              "lessThan": "OMI version: 1.6.8-1",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-09-15T12:15:15.090",
  "references": [
    {
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38647",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://packetstormsecurity.com/files/164694/Microsoft-OMI-Management-Interface-Authentication-Bypass.html",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-38647",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38647",
      "tags": [
        "US Government Resource"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Open Management Infrastructure (OMI) Remote Code Execution Vulnerability"
    },
    {
      "lang": "es",
      "value": "Una Vulnerabilidad de Ejecución de Código Remota de Open Management Infrastructure"
    }
  ],
  "lastModified": "2026-08-10T20:18:56.117",
  "cisaActionDue": "2021-11-17",
  "cisaExploitAdd": "2021-11-03",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DEC617A6-F1BC-44DE-A9BB-BECF2E788B0E"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "23A8B342-E863-4C71-9CE1-FB325FF34829"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:azure_diagnostics_\\(lad\\):-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "37AC51D6-F6F3-45D8-91E7-6EDD01C0273E"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:azure_security_center:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BA1626DA-5B19-4291-B840-633EF458984C"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:azure_sentinel:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B80F8C3B-BEF9-43D5-9455-6C6F608CF519"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:azure_stack_hub:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B457DA44-AD83-4E5C-B180-8A227462EC60"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "68A461E8-C834-4F97-98E3-516A191A3BAA"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FDAE892B-324C-45E3-BFA0-C2B7B6939F54"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BAB66E86-E1A2-484F-9A76-F04A308CB182",
              "versionEndExcluding": "1.6.8-1"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:system_center_operations_manager:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79983385-D5FE-4F76-924C-A2AA7E5BAAE8"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com",
  "cisaRequiredAction": "Apply updates per vendor instructions.",
  "cisaVulnerabilityName": "Microsoft Open Management Infrastructure (OMI) Remote Code Execution Vulnerability"
}