CVE-2024-37085
Published: 25 June 2024
Summary
CVE-2024-37085 is a medium-severity Improper Authentication (CWE-287) vulnerability in Vmware Esxi. Its CVSS base score is 6.8 (Medium).
Operationally, ranked in the top 0.9% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and IA-4 (Identifier Management).
Deeper analysis
VMware ESXi contains an authentication bypass vulnerability affecting hosts that were previously configured to use Active Directory for user management. The flaw, tracked under CWE-287 and CWE-305, allows an attacker to circumvent authentication controls tied to the default ESXi Admins group.
A malicious actor who already possesses sufficient Active Directory permissions can exploit the issue by re-creating the configured AD group after it has been deleted, thereby obtaining full administrative access to the ESXi host. The vulnerability carries a CVSS 3.1 score of 6.8 with network attack vector and high impact on confidentiality, integrity, and availability.
Broadcom security advisories detail the issue and are referenced in CISA’s Known Exploited Vulnerabilities catalog, indicating that mitigation guidance and any available patches should be obtained from those sources.
The CVE shows an EPSS score of 0.8027 at both current and peak values and appears in the CISA catalog, confirming real-world exploitation activity.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-36416
Vulnerability details
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html by re-creating the configured AD…
more
group ('ESXi Admins' by default) after it was deleted from AD.
- CWE(s)
- KEV Date Added
- 30 July 2024
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces approved authorizations for the ESXi Admins AD group, blocking the bypass achieved by deleting and recreating the group.
Requires proper management and uniqueness validation of security identifiers such as AD group names used for ESXi administrative access.
Mandates secure management of authenticators, preventing trivial recreation of the privileged AD group that ESXi trusts for authentication.