PT-2024-4164 · Vmware · Vcenter Server+1

Hao Zheng + 3 · Published 2024-06-18 · Updated 2026-05-04 · CVE-2024-37079

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VMware vCenter Server versions prior to 8.0U2d, 8.0U1e, and 7.0U3r

Description VMware vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. This out-of-bounds write flaw allows a malicious actor with network access to trigger the vulnerability by sending a specially crafted network packet, potentially leading to remote code execution. The vulnerability is actively being exploited in the wild, and CISA has added it to its Known Exploited Vulnerabilities Catalog. Successful exploitation can enable broad takeover and lateral movement across an organization’s virtual infrastructure. The vulnerability is rated with a CVSS score of 9.8, indicating critical severity.

Recommendations Update VMware vCenter Server to version 8.0U2d or later. Update VMware vCenter Server to version 8.0U1e or later. Update VMware vCenter Server to version 7.0U3r or later.

Fix

LPE

RCE

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

BDU:2024-04649

CVE-2024-37079

Affected Products

Vmware Vcenter

Vcenter Server

References · 166

• https://bdu.fstec.ru/vul/2024-04649 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/709115 · Security Note
• https://osv.dev/vulnerability/CVE-2024-37079 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37079 · Security Note
• https://twitter.com/cracbot/status/1804393946384339104 · Twitter Post
• https://twitter.com/pedri77/status/1935379588932149310 · Twitter Post
• https://twitter.com/ThreatSynop/status/2015111126799806693 · Twitter Post
• https://twitter.com/samilaiho/status/2025912827119108184 · Twitter Post
• https://twitter.com/cyashadotcom/status/2015074712163123597 · Twitter Post
• https://twitter.com/ScyScan/status/2014994097254342952 · Twitter Post
• https://twitter.com/fridaysecurity/status/2014982744443383992 · Twitter Post
• https://twitter.com/transilienceai/status/1838932700813504865 · Twitter Post
• https://t.me/true_secator/7837 · Telegram Post
• https://twitter.com/wvipersg/status/2014982588956385685 · Twitter Post
• https://twitter.com/ciberconsejo/status/2015708420494467382 · Twitter Post