Raw vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-20867 is a low-severity Improper Authentication (CWE-287) vulnerability in Debian Debian Linux. Its CVSS base score is 3.9 (Low).
Operationally, ranked in the top 4% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2023-20867 affects VMware Tools running on guest virtual machines hosted by VMware ESXi. The flaw allows a fully compromised ESXi host to force VMware Tools to bypass authentication checks for host-to-guest operations, resulting in limited impacts to the confidentiality and integrity of data within the guest VM. The vulnerability carries a CVSS 3.1 score of 3.9 and is associated with CWE-287 improper authentication.
An attacker who has already obtained full control of the ESXi host can leverage the issue to interfere with authenticated host-to-guest channels. Successful exploitation requires high privileges on the host, local access, and specific conditions that increase attack complexity, limiting the attacker to partial disclosure or modification of guest VM data without affecting availability.
The listed references consist of distribution mailing-list announcements that do not describe patches or mitigations for this VMware-specific issue. EPSS scores have remained low, with a current value of 0.0219 and a peak of 0.0313, indicating no significant post-disclosure exploitation interest.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-25040
Vulnerability Data
A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.
- CWE(s)
- KEV Date Added
- 23 June 2023
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Detects unauthorized successful logons resulting from improper authentication implementations.
Documented procedures ensure personnel are trained on authentication mechanisms, tangibly lowering the risk of improper authentication being exploited.
Security awareness training instructs users on secure authentication practices and avoiding credential compromise.
Training on authentication mechanisms and best practices decreases the occurrence of improper authentication.
Non-repudiation requires strong authentication mechanisms to irrefutably attribute performed actions to specific individuals or processes.
Session content review can reveal authentication bypasses or failures in session establishment.
Review of authentication-related audit records can detect improper authentication mechanisms or bypasses.
Assessments check authentication mechanisms for correct implementation and effectiveness, reducing successful authentication bypass attempts.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Mandating segregated approval and oversight for non-human identities reduces the chance that weak or orphaned credentials can be exploited for unauthorized authentication.
A.5.17 directly mandates generation of non-guessable unique secrets, secure transmission, immediate change of defaults/temporary creds, strong password enforcement, no-reuse, and compromise response, which stops most improper-authentication exploits at source; the bounded remainder is non-password authentication methods and sufficiency-of-proof cases (e.g. IA-2/IA-5 enhancements) left to other controls.
Security requirements specified early and verified through testing drive the consistent implementation of authentication mechanisms, decreasing the likelihood that authentication steps are omitted or incorrectly applied.
A.8.26 explicitly requires identifying and addressing authentication-related requirements (including level of trust in identity via 8.5 and 5.17) as part of application development or acquisition, which prevents a slice of CWE-287 but leaves the dominant sufficiency-of-proof aspects (IA-2/IA-5) and many implementation defects untouched.
A.8.27 mandates security-by-design principles (least privilege, default-deny, never-trust/always-verify, MFA, end-to-end encryption of requests, distrust-external-input, secure session control, and explicit authentication/authorization in every layer), which directly stops most improper-authentication flaws from being exploitable; the bounded remainder is insufficient-proof cases that live only in the strength or correctness of the credential itself (IA-5/IA-2 territory).
A.8.5 directly mandates appropriate-strength authentication techniques, MFA for critical systems, protected log-on procedures, brute-force resistance, no cleartext passwords/transmission, and session controls that stop exploitation of insufficient proof of identity; the bounded remainder is cases where the chosen technique itself is flawed or insufficiently implemented (e.g. weak biometrics without fallback).
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.