CVE-2024-38812

CRITICAL CISA KEV EPSS 98.9%
Published Sep 17, 20241y ago · Modified Jun 17, 20261w ago
9.8 CVSS 3.1
Critical
Find Similar
Published Sep 17, 2024 1y ago
Last Modified Jun 17, 2026 1w ago
KEV Listed Nov 20, 2024 1y ago
KEV Due Dec 11, 2024 566d overdue

Description

The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.

CVSS Details

Base Score
9.8
Exploitability
3.9
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

CISA Known Exploited Overdue 566d
Added
Nov 20, 2024
Due
Dec 11, 2024

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

EPSS Exploit Probability
98.9% percentile
Exploit & Patch Status
Actively Exploited (KEV)
No Patch Available

Weaknesses 2

CWE-122
CWE-787 Out-of-bounds Write Memory Safety

Affected Products 49

VendorProductVersionRange
vmwarecloud_foundation*≥4.0  –  <5.2
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server8.0any
vmwarevcenter_server8.0any
vmwarevcenter_server8.0any
vmwarevcenter_server8.0any
vmwarevcenter_server8.0any
vmwarevcenter_server8.0any
vmwarevcenter_server8.0any
vmwarevcenter_server8.0any
vmwarevcenter_server8.0any
vmwarevcenter_server8.0any
vmwarevcenter_server8.0any
vmwarevcenter_server8.0any
vmwarevcenter_server8.0any
vmwarevcenter_server8.0any
vmwarevcenter_server8.0any

References 2

  • support.broadcom.com https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24968
    Vendor Advisory
  • cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38812
    US Government Resource

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.