CVE-2024-38813

critical

Description

The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet.

References

https://www.bleepingcomputer.com/news/security/broadcom-warns-of-authentication-bypass-in-vmware-windows-tools/

https://www.bleepingcomputer.com/news/security/broadcom-fixes-three-vmware-zero-days-exploited-in-attacks/

https://www.theregister.com/2025/02/28/cisa_kev_list_ransomware/

https://isc.sans.edu/diary/rss/31510

https://thehackernews.com/2024/11/cisa-alert-active-exploitation-of.html

https://www.theregister.com/2024/11/18/vmware_vcenter_rce_exploited/

https://www.bleepingcomputer.com/news/security/critical-rce-bug-in-vmware-vcenter-server-now-exploited-in-attacks/

https://securityaffairs.com/171147/security/vmware-vcenter-server-bugs-actively-exploited.html

https://www.bleepingcomputer.com/news/security/vmware-fixes-bad-patch-for-critical-vcenter-server-rce-flaw/

https://www.securityweek.com/vmware-struggles-to-fix-flaw-exploited-at-chinese-hacking-contest/

https://thehackernews.com/2024/09/patch-issued-for-critical-vmware.html

https://cloud.google.com/support/bulletins/index#gcp-2024-051

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24968

Details

Source: Mitre, NVD

Published: 2024-09-17

Updated: 2024-10-02

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H