VMware CVE-2021-22005 Technical & Impact analysis

This report analyzes CVE-2021-22005, a critical (CVSS 9.8) unauthenticated RCE in VMware vCenter's analytics service that allows an attacker to control log file paths via request parameters and write arbitrary files as root (including to /etc/cron.d to achieve code execution). It includes root-cause analysis, exploit PoC details, detection techniques for vulnerable hosts and signs of compromise, and remediation guidance to patch or apply the provided workaround.