CVE-2024-37080: 
vSphere vCenter Server vulnerability analysis and mitigation

CVE-2024-37080 is a critical heap-overflow vulnerability discovered in VMware vCenter Server and Cloud Foundation's implementation of the DCERPC protocol. The vulnerability was disclosed on June 17, 2024, and affects multiple versions of vCenter Server (7.0 and 8.0) and Cloud Foundation (4.x and 5.x). This vulnerability has received a Critical severity rating with a CVSS v3.1 base score of 9.8 (VMware Advisory).

The vulnerability stems from a heap-overflow issue in the implementation of the DCERPC protocol within vCenter Server. The vulnerability can be triggered by sending specially crafted network packets to the affected system. The severity assessment indicates a Critical rating with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating network accessibility, low attack complexity, and no required privileges or user interaction (NVD).

If successfully exploited, this vulnerability could allow an attacker to achieve remote code execution on affected vCenter Server and Cloud Foundation systems. The high severity score indicates potential complete compromise of system confidentiality, integrity, and availability (VMware Advisory).

The vulnerability can be exploited by malicious actors with network access to vCenter Server by sending specially crafted network packets. As of current reports, there have been no observed exploits of this vulnerability in the wild (Arctic Wolf).

VMware has released patches to address this vulnerability. For vCenter Server 8.0, users should upgrade to version 8.0 U2d or 8.0 U1e, and for version 7.0, upgrade to 7.0 U3r. For Cloud Foundation 4.x and 5.x, users should refer to KB88287. No viable in-product workarounds are available, making patching the only effective mitigation strategy (VMware Advisory).