CVE-2024-37081
Vmware Vcenter Server 7.0 … 8.0
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2024-37081 is a high-severity ASP.NET Misconfiguration: Use of Identity Impersonation (CWE-556) vulnerability in Vmware Vcenter Server. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Valid Accounts (T1078); ranked in the top 9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-6 (Least Privilege) and CM-6 (Configuration Settings) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user with non-administrative privileges may exploit these issues to elevate privileges to root on vCenter Server Appliance. The issues affect the vCenter Server Appliance component and carry a CVSS 3.1 base score of 7.8.
An authenticated local attacker with low privileges can exploit the sudo misconfigurations to obtain root-level access on the appliance. Successful exploitation grants full control over the vCenter Server environment, including the ability to read, modify, or delete arbitrary data and affect availability.
Broadcom has published security advisories that address the vulnerabilities and are available at the referenced support pages. The current EPSS score stands at 0.4987 with a recorded peak of 0.5028.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-36414
Vulnerability Data
The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user with non-administrative privileges may exploit these issues to elevate privileges to root on vCenter Server Appliance.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Least privilege directly stops the assignment of unnecessary impersonated credentials that define this weakness.
Secure configuration settings prevent ASP.NET impersonation from being enabled with excessive rights.
Access enforcement stops the effects of over-privileged impersonation once configured.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Enforcing least privilege in access policy mitigates the unnecessary privileges that result from impersonation misconfiguration.
Configuration management directly prevents ASP.NET impersonation misconfigurations that grant excess privileges.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Control of privileged utility programs reduces the risk of unnecessary impersonated credentials being used for elevated operations.
Privileged access rights policy limits the use of impersonation to only what is strictly required.
Application security requirements can mandate that impersonation is disabled or tightly scoped.
Secure architecture principles discourage the use of impersonation in favor of proper delegation models.
Information access restriction ensures impersonated identities receive only the minimum necessary privileges.
Software installation procedures can enforce least-privilege configuration settings that avoid identity impersonation.