CVE-2024-37085: VMware ESXi Authentication Bypass Vulnerability
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.
Other sources
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Discontinue use of VMware ESXi and Horizon DaaS if mitigations are unavailable.
- Compensating control
Restrict Active Directory permissions to prevent unauthorized creation or re-creation of the AD group named 'ESXi Admins' (or the ESXi-configured AD group); limit who can create or manage AD groups used for ESXi authentication to trusted administrators only.
- Operational
Audit Active Directory and ESXi host logs for deletions and re-creations of the 'ESXi Admins' group (or the configured ESXi AD group) and investigate/remediate any unauthorized re-creation or related privilege changes.
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-37085?
CVE-2024-37085 is classified as a critical severity vulnerability due to its potential for unauthorized access.
How do I fix CVE-2024-37085?
To fix CVE-2024-37085, apply the security patch provided by VMware for the affected ESXi versions.
Who is affected by CVE-2024-37085?
CVE-2024-37085 affects VMware ESXi hosts that are configured to use Active Directory for user management.
Can CVE-2024-37085 be exploited remotely?
Yes, CVE-2024-37085 can be exploited remotely by a malicious actor with sufficient Active Directory permissions.
What impact does CVE-2024-37085 have on system security?
The impact of CVE-2024-37085 includes unauthorized full access to ESXi hosts, which can lead to data breaches and service disruptions.