The saga of VMware’s critical CVE-2024-38812 vCenter Server bug has reached the “exploitation detected” stage.
The difficult-to-fix vulnerability, first revealed at a Chinese hacking contest five months ago, is now being exploited in the wild, the company confirmed on Monday.
The virtualization technology giant issued an urgent update to its VMSA-2024-0019 bulletin with an acknowledgement of the live attacks and a call-to-arms for customers to prioritize the deployment of available fixes.
“VMware by Broadcom confirmed that exploitation has occurred in the wild for CVE-2024-38812 and CVE-2024-38813,” the company said.
VMware did not share any additional details on the observed exploitation or indicators of compromise (IOCs) to help defenders hunt for signs of infection.
The CVE-2024-38812 flaw, which carries a CVSS severity score of 9.8/10, has been a public embarrassment for VMware. Back in September, the company originally shipped a patch and credited research teams participating in the 2024 Matrix Cup, a hacking contest that took place in June and is sponsored by Chinese cybersecurity firm Qihoo 360 and Beijing Huayun’an Information Technology.
Four months later, the company was still struggling to patch the nasty bug, which exposes vCenter Server instances to remote code execution exploitation.
“VMware by Broadcom has determined that the vCenter patches released on September 17, 2024 did not fully address CVE-2024-38812,” the company said at the time. No additional details were provided.
The vulnerability is described as a heap-overflow in the Distributed Computing Environment / Remote Procedure Call (DCERPC) protocol implementation within vCenter Server.
A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution, VMware warned.
Related: VMware Struggles to Fix Flaw Exploited at Chinese Hacking Contest
Related: VMware Patches Code Execution Flaw Found in Chinese Hacking Contest
Related: VMware Patches High-Severity SQL Injection Flaw in HCX Platform
Related: Chinese Spies Exploited VMware vCenter Server Vulnerability Since 2021
Related: $2.5 Million Offered at Upcoming ‘Matrix Cup’ Chinese Hacking Contest
