Actively exploited · Published Jun 25, 2024 · Assigned by vmware
CVE-2024-37085
Medium 6.8 Exploited Ransomware
In plain English
A medium-severity security flaw in VMware Cloud Foundation. Attackers are actively exploiting it in the wild (listed by CISA on July 30, 2024). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 26.8% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Aug 20, 2024.
Official description
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | VMware ESXi | 8.0 – before ESXi80U3-240225107.0 |
| n/a | VMware Cloud Foundation | 5.x4.x |
Weakness: CWE-305 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H