CVE-2024-38813

CRITICAL CISA KEV EPSS 96.6%
Published Sep 17, 20241y ago · Modified Jun 17, 20261w ago
9.8 CVSS 3.1
Critical
Find Similar
Published Sep 17, 2024 1y ago
Last Modified Jun 17, 2026 1w ago
KEV Listed Nov 20, 2024 1y ago
KEV Due Dec 11, 2024 566d overdue

Description

The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet.

CVSS Details

Base Score
9.8
Exploitability
3.9
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

CISA Known Exploited Overdue 566d
Added
Nov 20, 2024
Due
Dec 11, 2024

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

EPSS Exploit Probability
96.6% percentile
Exploit & Patch Status
Actively Exploited (KEV)
No Patch Available

Weaknesses 2

CWE-250
CWE-273

Affected Products 49

VendorProductVersionRange
vmwarecloud_foundation*≥4.0  –  <5.2
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server7.0any
vmwarevcenter_server8.0any
vmwarevcenter_server8.0any
vmwarevcenter_server8.0any
vmwarevcenter_server8.0any
vmwarevcenter_server8.0any
vmwarevcenter_server8.0any
vmwarevcenter_server8.0any
vmwarevcenter_server8.0any
vmwarevcenter_server8.0any
vmwarevcenter_server8.0any
vmwarevcenter_server8.0any
vmwarevcenter_server8.0any
vmwarevcenter_server8.0any
vmwarevcenter_server8.0any
vmwarevcenter_server8.0any

References 2

  • support.broadcom.com https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24968
    Vendor Advisory
  • cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38813
    US Government Resource

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.