PT-2024-6262 · Vmware · Vmware Vcenter Server+1

Srs + 1 · Published 2024-09-17 · Updated 2026-03-10 · CVE-2024-38812

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VMware vCenter Server versions 7.0 through 8.0 VMware Cloud Foundation versions 7.0 through 8.0

Description VMware vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access can exploit this vulnerability by sending a specially crafted network packet, potentially leading to remote code execution. This vulnerability, tracked as CVE-2024-38812, has a CVSS score of 9.8 and is actively exploited. The initial patch released in September 2024 did not fully address the vulnerability, requiring a subsequent update. The vulnerability was also demonstrated during a hacking contest. Over 2,800 systems are exposed online.

Recommendations Apply the latest security updates for VMware vCenter Server version 7.0 Update 3t or later. Apply the latest security updates for VMware vCenter Server version 8.0 Update 2e or later. Apply the latest security updates for VMware Cloud Foundation version 7.0 Update 3t or later. Apply the latest security updates for VMware Cloud Foundation version 8.0 Update 2e or later.

Fix

RCE

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

BDU:2024-07209

CVE-2024-38812

Affected Products

Vmware Vcenter

Vmware Vcenter Server

References · 254

• https://osv.dev/vulnerability/CVE-2024-38812 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-38812 · Security Note
• https://bdu.fstec.ru/vul/2024-07209 · Security Note
• https://twitter.com/securityRSS/status/1858677213559734530 · Twitter Post
• https://twitter.com/hackplayers/status/1836314234117906651 · Twitter Post
• https://t.me/thehackernews/5908 · Telegram Post
• https://twitter.com/Ind_Cyber_News/status/1848746640959533181 · Twitter Post
• https://twitter.com/AnonTroyano303/status/1836314717188690416 · Twitter Post
• https://t.me/avleonovcom/1440 · Telegram Post
• https://twitter.com/infosecWithjosh/status/1836272755391840548 · Twitter Post
• https://twitter.com/ncsc_gov_ie/status/1837092933784232132 · Twitter Post
• https://twitter.com/ReneRobichaud/status/1836391754695663677 · Twitter Post
• https://twitter.com/pedri77/status/1963513042953535855 · Twitter Post
• https://twitter.com/IT_news_for_all/status/1836271876047265952 · Twitter Post
• https://twitter.com/SecurityWeek/status/1836103163918561453 · Twitter Post