VMware ESXi, VMware Cloud Foundation: authentication bypass (CVE-2024-37085) #shorts #breaking
CVE
This CVE relates to an authentication bypass vulnerability found in VMware ESXi. The vulnerability is about 4 months old and is categorized as a zero-day exploit, meaning it was not previously known and has no immediate fix upon discovery. Specifically, a malicious actor with the necessary Active Directory permissions can achieve full access to an ESXi host. This is possible if the ESXi host was configured to use Active Directory for user management and the attacker is able to re-create the AD group 'ESXi Admins' after it was deleted. This insidious flaw primarily targets organizations utilizing affected versions of VMware ESXi, which include versions less than ESXi80U3-24022510 and version 7.0, as well as VMware Cloud Foundation versions 5.x and 4.x.
Watch the full video on YouTube: CVE-2024-37085
Remediation and exploitation details
This chain involves the following actors
This following systems are involved
Attack entry point
Remediation actions
Exploitation actions
Related Content
NOTE: The following related content has not been vetted and may be unsafe.