CVE-2024-37080

Summary

vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.

Affected Software

VendorProductVersion RangeStatus
n/aVMware vCenter Server8.0 < 8.0 U2daffected
n/aVMware vCenter Server8.0 < 8.0 U1eaffected
n/aVMware vCenter Server7.0 < 7.0 U3raffected
n/aVMware Cloud Foundation5.xaffected
n/aVMware Cloud Foundation4.xaffected

Weaknesses

  • Heap-overflow vulnerability

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: yes
    • Technical Impact: total

CVE Program Container

Additional References

References