# CVE-2021-21978: VMware View Planner - RCE

> Live exploitation tracking for CVE-2021-21978 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2021-21978

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** VMware View Planner
- **Weaknesses:** CWE-20 (Improper Input Validation); CWE-862 (Missing Authorization)
- **Tags:** enterprise_software

## Description

VMware View Planner 4.x prior to 4.6 Security Patch 1 contains a remote code execution vulnerability. Improper input validation and lack of authorization leading to arbitrary file upload in logupload web application. An unauthorized attacker with network access to View Planner Harness could upload and execute a specially crafted file leading to remote code execution within the logupload container.

## CrowdSec analysis

[CVE-2021-21978](https://euvd.enisa.europa.eu/vulnerability/CVE-2021-21978) is a critical remote code execution vulnerability due to improper input validation and missing authorization in the logupload web application. Attackers with network access can exploit this flaw to upload and execute arbitrary files, potentially gaining full control over the affected container. This vulnerability could be leveraged for further lateral movement, data theft, or disruption of services within the targeted environment.

CrowdSec has been tracking this vulnerability and its exploits since 10th of July 2025.

CrowdSec network observations suggest that most exploitation of CVE-2021-21978 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental.
CrowdSec data also reveals a clear uptick in attacks involving CVE-2021-21978 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Attackers exploit the `/logupload` endpoint of VMware View Planner by sending a POST request with a crafted `logMetaData` parameter containing path traversal sequences, enabling arbitrary file upload and potential remote code execution.

## Timeline

- 2021-03-03: CVE Published. CVE-2021-21978 is published to NVD.
- 2025-07-10: Rule Released. CrowdSec releases a rule to detect CVE-2021-21978 exploitation attempts against the CrowdSec Network.
- 2025-07-21: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2021-21978 for the first time.

## References

- http://packetstormsecurity.com/files/161879/VMware-View-Planner-4.6-Remote-Code-Execution.html
- https://www.vmware.com/security/advisories/VMSA-2021-0003.html
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21978.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2021-21978) follows observed exploitation activity for CVE-2021-21978. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.