CVE-2024-37085mediumunder attackransomwareCWE-305

CVE-2024-37085: medium-severity vulnerability in VMware ESXi

Published · Updated

Follow this CVE+ Monitor VMware Cloud Foundation+ Monitor ESXi

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

68Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA, has an official Brazilian government alert, has a public proof of concept and 3 threat group(s) use it.

ssvc Actcvss 6.8epss 27%
from disclosure to weapon38 days
Published on NVDJun 25
1st PoC+38d
CISA KEV+35d
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

  • CTIR Gov · ALERTA 11/2024Ataques Cibernéticos a Sistemas de Virtualizaçãoread on gov.br ↗
Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
Who exploits it — 3

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

RansomwareBlackByte MITRE ATT&CK
RansomwareAkira public group profile
Ransomwareblackbasta public group profile
Action required by CISAfederal deadline: 2024-08-20

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

VMware ESXi can be compromised if a malicious actor with Active Directory admin rights deletes and recreates the default ESXi admin group, bypassing authentication and gaining full host access. This matters because it allows attackers to take complete control of virtualized infrastructure.

Technical detail

An authentication bypass exists in VMware ESXi when configured for AD-based user management (CWE-305). An attacker with sufficient AD permissions can delete the configured ESXi admin group and recreate it with their own membership, circumventing the intended access controls and gaining unauthorized administrative access to the ESXi host.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · VMware Cloud Foundationn/a · VMware ESXi
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.