PT-2024-4293 · Vmware · Vcenter Server+1

Hao Zheng + 3 · Published 2024-06-18 · Updated 2026-02-23 · CVE-2024-37080

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VMware vCenter Server (affected versions not specified)

Description The issue is a heap-overflow vulnerability in the implementation of the DCERPC protocol within VMware vCenter Server. A malicious actor with network access can trigger this by sending a specially crafted network packet, potentially leading to remote code execution. The vulnerability is due to improper memory handling during the processing of DCERPC protocol requests. The DCERPC protocol is a remote procedure call mechanism used for communication between different components of the vCenter Server. Exploitation allows an unauthenticated attacker to execute arbitrary code on the server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

BDU:2024-04780

CVE-2024-37080

Affected Products

Vmware Vcenter

Vcenter Server

References · 30

• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24453 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-37080 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37080 · Security Note
• https://bdu.fstec.ru/vul/2024-04780 · Security Note
• https://twitter.com/SmiitCyberAI/status/1803741284739453268 · Twitter Post
• https://t.me/sysadm_in_up/2507 · Telegram Post
• https://t.me/securixy_kz/894 · Telegram Post
• https://twitter.com/Action1corp/status/1810738390163411390 · Twitter Post
• https://t.me/true_secator/5867 · Telegram Post
• https://t.me/pentestingnews/48206 · Telegram Post
• https://twitter.com/cracbot/status/1804393947856597041 · Twitter Post
• https://twitter.com/cracbot/status/1804756317602808164 · Twitter Post
• https://t.me/avleonovcom/1388 · Telegram Post
• https://twitter.com/ksg93rd/status/1803824119957402112 · Twitter Post
• https://twitter.com/pedri77/status/1935379588932149310 · Twitter Post