VMware · ESXi
CVE-2024-37085
VMware ESXi Authentication Bypass Vulnerability
概要
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.
CISA: VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.
対処法
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
米国連邦機関の対応期限：2024年8月20日
VMwareのその他の悪用された脆弱性
| 追加日 | 脆弱性 | 製品 | 深刻度 | 攻撃の可能性 |
|---|---|---|---|---|
| 2025/03/04 | Arbitrary Write | ESXi | 高 8.2 | 1.0% |
| 2021/11/03 | OpenSLP Use-After-Free | ESXi | 緊急 9.8 | 83% |
| 2025/03/04 | TOCTOU Race Condition | ESXi and Workstation | 緊急 9.3 | 1.6% |
| 2025/03/04 | Information Disclosure | ESXi, Workstation, and Fusion | 高 7.1 | 1.6% |
| 2024/11/20 | Heap-Based Buffer Overflow | vCenter Server | 緊急 9.8 | 55% |
| 2024/11/20 | Privilege Escalation | vCenter Server | 高 7.5 | 17% |
| 2024/07/17 | Incorrect Default File Permissions Vulnerability | vCenter Server | 中 6.5 | 13% |
| 2024/01/22 | Out-of-Bounds Write | vCenter Server | 緊急 9.8 | 99.2% |
出典：Known Exploited Vulnerabilities（CISA、パブリックドメイン）、CVE records（cve.org）、EPSS（FIRST）。攻撃の可能性は、今後30日以内に誰かがその脆弱性の悪用を試みるというEPSSの推定値です。