CVE-2024-37079

Published Jun 18, 2024

Last updated 14 days ago

VMware

vCenter Server

Overview

AI description

Automated description summarized from trusted sources.

CVE-2024-37079 is a heap-overflow vulnerability found within the DCERPC protocol implementation of VMware vCenter Server. This flaw allows a malicious actor with network access to the vCenter Server to send specially crafted network packets. Successful exploitation of this vulnerability can lead to remote code execution on the affected server. This vulnerability has been observed to be actively exploited in the wild.

Description: vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.
Source: security@vmware.com
NVD status: Analyzed
Products: cloud_foundation, vcenter_server

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability
Exploit added on: Jan 23, 2026
Exploit action due: Feb 13, 2026
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

nvd@nist.gov: CWE-787
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-787

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7FA8DFE6-9C74-4711-A8AF-3B170876A1F9",
            "versionEndExcluding": "5.2",
            "versionStartIncluding": "4.0"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "CC974CA1-88D3-42E4-BF1F-28870F8171B5"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:a:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "EFE63984-F69B-4593-9AEC-D179D6D98B08"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:b:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "34D1F3B3-8E3F-4E4D-8EE6-2F593663B5CC"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:c:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "16F3D992-9F48-4604-9AAF-DC2D1CE98BE2"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C745A7E6-4760-48CD-B7C4-1C2C20217F21"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update1a:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A5522514-8ED9-45DB-9036-33FE40D77E7D"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update1b:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8C27C660-E917-4944-8B4C-41D9622B76D7"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update1c:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "56CFB469-B3E6-4503-A47C-D18206D4D19A"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update1d:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "67024A43-9E13-4F4E-B711-731792DA3840"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "604F559F-1775-4F29-996E-9079B99345B6"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update2a:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "61DC9400-5AEE-49AC-9925-0A96E32BD8C0"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update2b:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "98C1B77E-AB0E-4E8A-8294-2D3D230CDF9B"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:8.0:update2c:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8EC8BEF1-7908-46C0-841A-834778D1A863"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "5FA81CCD-A05E-498C-820E-21980E92132F"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:a:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0EE83406-A3D9-4F75-A1A6-63831CEBEEC1"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:b:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FB563627-C9CF-4D8A-B882-9AB65EAE9E15"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:c:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DCA03B2A-48B2-48AD-B8EB-9D7BB2016819"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:d:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A2392D0F-D7A2-4E01-9212-1BA6C895AEBF"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6D731C1A-9FE5-461C-97E2-6F45E4CBABE1"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update1a:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8725E544-2A94-4829-A683-1ECCE57A74A6"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update1c:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0FC6765A-6584-45A8-9B21-4951D2EA8939"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update1d:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "85DD238C-EF73-44F0-928E-A94FF5C4B378"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F4CA36C1-732E-41AE-B847-F7411B753F3D"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update2a:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0DA882B6-D811-4E4B-B614-2D48F0B9036E"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update2b:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8D30A78E-16D0-4A2E-A2F8-F6073698243E"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update2c:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "188E103E-9568-4CE0-A984-141B2A9E82D2"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update2d:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B266439F-E911-4C95-9D27-88DF96DDCCD5"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update3:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6508A908-EF14-4A72-AC75-5DA6F8B98A0E"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update3a:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3BAD2012-5C82-4EA9-A780-9BF1DA5A18AB"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update3c:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "58597F18-0B23-4D21-9ABA-D9773958F10E"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update3d:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "ADF46C54-313B-4742-A074-EEA0A6554680"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update3e:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9587F800-57BC-44B6-870E-95691684FC46"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update3f:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "AD148A75-5076-416D-AFD6-0F281DA0A82B"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update3g:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "956CEA8C-F8C4-41BD-85B4-44FE3A772E50"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update3h:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "008AEA0F-116B-4AF8-B3A7-3041CCE25235"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update3i:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "EE486B2F-AED4-4FCE-A674-DFC25844FEFF"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update3j:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4F73AA9E-51E9-4FA0-813D-AD05FDC3EF94"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update3k:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "455DD46E-A071-476D-8914-767485E45F35"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update3l:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3A422D04-48DF-4A16-94F8-D5702CC2782D"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update3m:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "806E9219-CDF4-4E62-978E-334E96A94BA6"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update3n:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "34D8B182-4E71-4655-8DD8-743A3EF6DC8B"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update3o:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8D8F6CC7-6B6D-4079-9E2C-A85C4616FF92"
          },
          {
            "criteria": "cpe:2.3:a:vmware:vcenter_server:7.0:update3p:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A814F0AB-4AEB-4139-976F-425A4A9EC67B"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.