PT-2023-6424 · Vmware · Vmware Vcenter Server+1

Grigory Dorodnov · Publicado 2023-10-24 · Atualizado 2026-03-07 · CVE-2023-34048

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VMware vCenter Server versions prior to October 2023

Description VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability, potentially leading to remote code execution. This vulnerability has been actively exploited by the Chinese espionage group UNC3886 since late 2021, targeting defense, government, telecom, and technology sectors in the US and APJ regions. The vulnerability allows attackers to compromise hypervisors, install HTTP backdoors, access guests using PowerCLI, and run unregistered VMs via the VMware CLI. Hundreds of potentially vulnerable instances have been identified globally.

Recommendations Update VMware vCenter Server to the latest version available as of October 2023.

Exploit

Correção

RCE

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

BDU:2023-07140

CVE-2023-34048

ZDI-23-1590

Produtos afetados

Vmware Vcenter

Vmware Vcenter Server

Referências · 171

• 🔥 https://vicarius.io/vsociety/posts/understanding-cve-2023-34048-a-zero-day-out-of-bound-write-in-vcenter-server · Exploit
• https://twitter.com/VerSprite/status/1749458479536807999 · Publicação no Twitter
• https://twitter.com/Winfieldarctic/status/1719765190458147134 · Publicação no Twitter
• https://twitter.com/the_yellow_fall/status/1748286526071644220 · Publicação no Twitter
• https://twitter.com/rfwaveio/status/1748909901437366448 · Publicação no Twitter
• https://twitter.com/MertSARICA/status/1749419315969872218 · Publicação no Twitter
• https://twitter.com/SecurityWeek/status/1748285539269116251 · Publicação no Twitter
• https://twitter.com/transilienceai/status/1951526817598263680 · Publicação no Twitter
• https://t.me/thehackernews/4052 · Publicação no Telegram
• https://t.me/cibsecurity/72836 · Publicação no Telegram
• https://twitter.com/security_wang/status/1748653059188682766 · Publicação no Twitter
• https://twitter.com/opsmatters_uk/status/1718025368127361110 · Publicação no Twitter
• https://twitter.com/pineda_security/status/1749258400398205100 · Publicação no Twitter
• https://twitter.com/PTerlisten/status/1748667337828376874 · Publicação no Twitter
• https://twitter.com/spontiroli/status/1748816671404376348 · Publicação no Twitter