CVE-2024-37079

critical

Description

vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.

References

References

https://www.bleepingcomputer.com/news/security/critical-rce-bug-in-vmware-vcenter-server-now-exploited-in-attacks/

https://securityaffairs.com/171147/security/vmware-vcenter-server-bugs-actively-exploited.html

https://thehackernews.com/2024/09/patch-issued-for-critical-vmware.html

https://www.bleepingcomputer.com/news/security/broadcom-fixes-critical-rce-bug-in-vmware-vcenter-server/

https://www.thezdi.com/blog/2024/8/27/cve-2024-37079-vmware-vcenter-server-integer-underflow-code-execution-vulnerability

https://www.helpnetsecurity.com/2024/06/18/cve-2024-37079-cve-2024-37080/

https://thehackernews.com/2024/06/vmware-issues-patches-for-cloud.html

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24453

https://cloud.google.com/support/bulletins/index#gcp-2024-037

Details

Source: Mitre, NVD

Published: 2024-06-18

Updated: 2025-03-14

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.11662