Threat Actors Chaining Unpatched VMware Vulnerabilities for Full System Control¶
Cybersecurity and Infrastructure Security Agency (CISA). (2022). Threat Actors Chaining Unpatched VMware Vulnerabilities for Full System Control.
Cited by¶
1 citation across 1 artifact.
Each citation links to the sentence it supports in the citing article.
Primes¶
- Conjunctive Path Activation
- In security, exploit chains weaponize a sequence of individually non-exploitable vulnerabilities when the AND of their presence, reachability, and input format realizes.
This sourceDocuments an exploit chain in which CVE-2022-22954 and CVE-2022-22960 are weaponized in combination — individually limited vulnerabilities that, only when co-present and chained, yield full system control, the AND-across-vulnerabilities structure.
Supported in partVerified against the work's full text
CISA documents actors chaining two VMware CVEs for root access, but also says each is exploited separately, so 'individually non-exploitable' does not match.
“are exploiting CVE-2022-22954 and CVE-2022-22960 separately and in combination”
- In security, exploit chains weaponize a sequence of individually non-exploitable vulnerabilities when the AND of their presence, reachability, and input format realizes.
Verification¶
Does it exist? Not checked yet. This entry carries no identifier to resolve. It was extracted from the citation as written in the article, normalized, and deduplicated against the rest of the registry.
Does it back the claim? Read against the text for 1 of 1 citation: 1 supported in part. Each verdict is shown under its citation below, with what in the work backs the sentence.
Support is checked per citation rather than per work — the same source can be cited soundly in one article and wrongly in another. Per-citation recording began recently, so a citation with no recorded check is a gap in the record rather than evidence it went unchecked.
See how references were verified.
Registry ID ref:b21de1b00112 · see in the full table