CVE-2023-34048
CRITICALCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionNVD
vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution.
AnalysisAI
VMware vCenter Server contains an out-of-bounds write in the DCERPC protocol implementation allowing unauthenticated remote code execution, exploited by Chinese APT groups for ESXi infrastructure compromise.
Technical ContextAI
The CWE-787 out-of-bounds write in the DCERPC protocol implementation allows a network-adjacent attacker to corrupt memory through crafted protocol messages. The exploitation requires only network access to the vCenter Server's DCERPC port (port 443 for vSphere Client embeds DCERPC handling).
Affected ProductsAI
VMware vCenter Server (affected versions before patches)
RemediationAI
Apply VMware security patches immediately. Check ESXi hosts for indicators of VirtualPita/VirtualPie. Restrict network access to vCenter management interfaces. Implement vCenter Server High Availability (VCHA) for detection.
Share
External POC / Exploit Code
Leaving vuln.today