PT-2023-6424 · Vmware · Vmware Vcenter Server+1

Grigory Dorodnov · Published 2023-10-24 · Updated 2026-03-07 · CVE-2023-34048

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VMware vCenter Server versions prior to October 2023

Description VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability, potentially leading to remote code execution. This vulnerability has been actively exploited by the Chinese espionage group UNC3886 since late 2021, targeting defense, government, telecom, and technology sectors in the US and APJ regions. The vulnerability allows attackers to compromise hypervisors, install HTTP backdoors, access guests using PowerCLI, and run unregistered VMs via the VMware CLI. Hundreds of potentially vulnerable instances have been identified globally.

Recommendations Update VMware vCenter Server to the latest version available as of October 2023.

Exploit

Fix

RCE

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2023-07140

CVE-2023-34048

ZDI-23-1590

Affected Products

Vmware Vcenter

Vmware Vcenter Server

References · 171

• 🔥 https://vicarius.io/vsociety/posts/understanding-cve-2023-34048-a-zero-day-out-of-bound-write-in-vcenter-server · Exploit
• https://bdu.fstec.ru/vul/2023-07140 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-34048 · Security Note
• https://osv.dev/vulnerability/CVE-2023-34048 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-23-1590 · Security Note
• https://twitter.com/VerSprite/status/1749458479536807999 · Twitter Post
• https://twitter.com/Winfieldarctic/status/1719765190458147134 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1748286526071644220 · Twitter Post
• https://twitter.com/rfwaveio/status/1748909901437366448 · Twitter Post
• https://twitter.com/MertSARICA/status/1749419315969872218 · Twitter Post
• https://twitter.com/SecurityWeek/status/1748285539269116251 · Twitter Post
• https://twitter.com/transilienceai/status/1951526817598263680 · Twitter Post
• https://t.me/thehackernews/4052 · Telegram Post
• https://t.me/cibsecurity/72836 · Telegram Post
• https://twitter.com/security_wang/status/1748653059188682766 · Twitter Post