VMware vCenter Exploit - CVE-2020-3952

An attacker with network access to port 389 on an affected vCenter server can exploit an access control vulnerability in the VMware Directory Service (vmdir). First, the attacker attempts to create a session by sending fake LDAP credentials to the vCenter server. The LDAP authentication attempt fails (1), as expected, but vmdir creates an unauthenticated session with the attacker. The attacker successfully runs an LDAP command to create a user (2) and then runs another command to add the new user to an administrator group. As this new administrator user, the attacker can gain complete control of the vCenter system.