Scans for Proxmox Servers, (Wed, Sep 9th)
Source SANS ISC Handlers Diary
Description
A vulnerability in older versions of Proxmox VE version 7, which is no longer supported, was disclosed about a week ago. Following the advisory, there has been an increase in scanning activity targeting Proxmox servers, particularly on port 8006, along with brute force login attempts against the API endpoints. The scans and brute force attempts are observable in server logs with HTTP status codes 401 and 308. The vulnerability affects only version 7 of Proxmox VE, which has been unsupported for several years.
Impact
The vulnerability affects only Proxmox VE version 7, which is no longer supported. The increased scanning and brute force attempts could lead to unauthorized access if the vulnerability is successfully exploited on vulnerable systems. However, no active exploits in the wild have been confirmed. Systems running unsupported versions remain at risk if exposed to the internet without additional protections.
Defensive guidance
Since Proxmox VE version 7 is no longer supported, users should upgrade to a supported version of Proxmox VE to eliminate exposure to this vulnerability. Systems still running version 7 should be isolated from untrusted networks or have additional access controls to prevent unauthorized access. Monitoring for brute force attempts and blocking suspicious IPs may reduce risk. Patch status is not confirmed in the provided data; users should consult the official Proxmox advisory for current remediation guidance.