netVigilance Vulnerability intelligence since 2004
CVE-2024-38813 · netVigilance record NV24-0166

VMware vCenter Server Privilege Escalation

past due

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA deadline 2024-12-11 · passed 1 year 8 months ago · applies to US federal civilian agencies; used elsewhere as a reference SLA

What happened

VMware vCenter contains an improper check for dropped privileges vulnerability. This vulnerability could allow an attacker with network access to the vCenter Server to escalate privileges to root by sending a specially crafted packet.

Who is affected

VMware vCenter Server. Affected version ranges are listed in the vendor advisory and the NVD entry linked under Sources.

Weakness class: CWE-250, CWE-273.

Timeline

  1. Added to CISA KEVExploitation in the wild confirmed by CISA
  2. CISA remediation deadlinepassed 1 year 8 months ago

Sources