CVE-2024-38813KEV · OVERDUECWE-250CWE-273

Privilege escalation vulnerability

High · published September 17, 2024

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.5. It is confirmed in active exploitation. It sits in the 97.1th percentile for exploit probability.

682
days past CISA
deadline
CVSS v3.1
7.5
EPSS
17%
Percentile
97.1
In the wild
Confirmed
What it is

🚨 A specially crafted network packet is all it takes to escalate privileges to root in vCenter Server! ⚡ Think of it like a delivery driver who finds a way to sneak in their own VIP access card to the secure area of a warehouse — with just the right approach, they can access everything stored inside! If exploited, a malicious actor could gain root access, allowing them to control and manipulate the entire server environment — absolutely devastating for security! This could lead to unauthorized data manipulation, service disruptions, or worse, a complete takeover of your virtual infrastructure.

Put simply

Think of it like a delivery driver who finds a way to sneak in their own VIP access card to the secure area of a warehouse — with just the right approach, they can access everything stored inside! This privilege escalation vulnerability allows an attacker with network access to send malicious packets that trigger an exploit, elevating their privileges to root without proper authorization.

What to do

If exploited, a malicious actor could gain root access, allowing them to control and manipulate the entire server environment — absolutely devastating for security! This could lead to unauthorized data manipulation, service disruptions, or worse, a complete takeover of your virtual infrastructure. Patch your vCenter Server immediately to the latest version. Ensure that access controls are tightened and consider monitoring network traffic for any unusual packet activity. Don't delay on this one! You've got this! With a quick patch and some vigilance, you can secure your environment in no time. 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.17355 · 97.1th percentile
Weaknesses
CWE-250 · Execution with Unnecessary Privileges; CWE-273 · Improper Check for Dropped Privileges
Published
2024-09-17T17:13Z
KEV added
2024-11-20 · due 2024-12-11
EPSS history
Timeline
  • 20 NOV 00:00Z
    Added to CISA KEV — remediate by Dec 11
    kev
  • 17 SEP 17:13Z
    Privilege escalation vulnerability
    cvelistv5