CyberSecBulletin
CVE-2024-37085Exploited in the wildNVD status: Analyzed

VMware ESXi Authentication Bypass

Published Updated By the CyberSecBulletin desk

CVE-2024-37085 is a high-severity improper authentication vulnerability in VMware ESXi, with a CVSS 3.1 base score of 7.2 out of 10. It can be exploited remotely over the network by an attacker with administrator privileges, without any action from a user. The record lists version ESXi80U3-24022510 as the first without the flaw, so updating VMware ESXi to that release or later removes the exposure. CISA added it to the Known Exploited Vulnerabilities catalogue on July 30, 2024, which means attacks have been observed in the wild, including in ransomware campaigns.

Patch now

Attackers are already exploiting this vulnerability, according to CISA.

What to do

  1. Update VMware ESXi to ESXi80U3-24022510 or a later version.
  2. Update esxi to ESXi80U3-24022510 or a later version.
  3. Update cloud_foundation to 5.2 or 5.0, whichever matches your release line, or a later version.
  4. CISA's required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
  5. Read the advisory on support.broadcom.com for workarounds and exact fixed builds.

Affected products and versions

VendorProductAffected versionsFixed in
VMware ESXiVMware ESXi8.0 up to, but not including, ESXi80U3-24022510; 7.0ESXi80U3-24022510
VMware Cloud FoundationVMware Cloud Foundation5.x; 4.xNot stated
VMwareesxi7.0; 8.0 up to, but not including, ESXi80U3-24022510ESXi80U3-24022510
VMwarecloud_foundation5.0 up to, but not including, 5.2; 4.0 up to, but not including, 5.05.2, 5.0

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
HighAdministrator-level access is required first.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.16.8MediumCNA (vmware.com)
CVSS 3.17.2HighNVD

Official description

VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

How developers prevent this class of flaw

  • Use an authentication framework or library such as the OWASP ESAPI Authentication feature.

More Improper Authentication vulnerabilities (CWE-287)

Timeline

  1. CVE record published.
  2. Added to CISA's Known Exploited Vulnerabilities catalogue.
  3. CISA published its SSVC assessment (exploitation: active, automatable: no, technical impact: total).
  4. Deadline for US federal agencies to remediate, set by CISA.
  5. Record last changed materially (score, affected products, status or references).

References

Third-party and government advisories

Other vulnerabilities in VMware ESXi

All VMware ESXi vulnerabilities

Recent Improper Authentication vulnerabilities

Spotted an error? Tell us.