VULNERA Pulse

CVE-2024-37080

CRITICAL CVSS 9.80 EPSS Score 0.04 EPSS Percentile 9.04

Remote Code Execution

Published: June 18, 2024

vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.

Quotes

• Heap-overflow vulnerabilities in the implementation of the DCE/RPC protocol
• The increasing popularity of cloud computing has led to a corresponding surge in VM usage, consolidating multiple applications onto a single physical server
• A malicious actor with network access to vCenter Server may trigger these vulnerabilities by sending a specially crafted network packet potentially leading to remote code execution
• There may be other mitigations and compensating controls available in your organization, depending on your security posture, defense-in-depth strategies, and configurations of perimeter firewalls and appliance firewalls. All organizations must decide for themselves whether to rely on those protections

Headlines

• June 18, 2024 - Critical VMware Bugs Open Swaths of VMs to RCE, Data Theft
• June 18, 2024 - VMware fixes critical vCenter RCE vulnerability, patch now
• June 18, 2024 - VMware fixed RCE and privilege escalation bugs in vCenter Server
• June 18, 2024 - VMware Discloses Critical Vulnerabilities, Urges Immediate Remediation
• June 18, 2024 - Critical RCE flaws in vCenter Server fixed (CVE-2024-37079, CVE-2024-37080)
• June 18, 2024 - VMware Issues Patches for Cloud Foundation, vCenter Server, and vSphere ESXi
• June 18, 2024 - VMware by Broadcom warns of critical vCenter flaws
• June 18, 2024 - CVE-2024-37079, CVE-2024-37080: Critical VMware vCenter Server Vulnerabilities Demand Immediate Action

CVE-2024-37079

CRITICAL CVSS 9.80 EPSS Score 0.04 EPSS Percentile 9.04

Remote Code Execution Public Exploits Available

Published: June 18, 2024

vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.

Quotes

• Heap-overflow vulnerabilities in the implementation of the DCE/RPC protocol
• The increasing popularity of cloud computing has led to a corresponding surge in VM usage, consolidating multiple applications onto a single physical server
• A malicious actor with network access to vCenter Server may trigger these vulnerabilities by sending a specially crafted network packet potentially leading to remote code execution
• There may be other mitigations and compensating controls available in your organization, depending on your security posture, defense-in-depth strategies, and configurations of perimeter firewalls and appliance firewalls. All organizations must decide for themselves whether to rely on those protections

Headlines

• June 18, 2024 - Critical VMware Bugs Open Swaths of VMs to RCE, Data Theft
• June 18, 2024 - VMware fixes critical vCenter RCE vulnerability, patch now
• June 18, 2024 - VMware fixed RCE and privilege escalation bugs in vCenter Server
• June 18, 2024 - VMware Discloses Critical Vulnerabilities, Urges Immediate Remediation
• June 18, 2024 - Critical RCE flaws in vCenter Server fixed (CVE-2024-37079, CVE-2024-37080)
• June 18, 2024 - VMware Issues Patches for Cloud Foundation, vCenter Server, and vSphere ESXi
• June 18, 2024 - VMware by Broadcom warns of critical vCenter flaws
• June 18, 2024 - CVE-2024-37079, CVE-2024-37080: Critical VMware vCenter Server Vulnerabilities Demand Immediate Action

CVE-2024-3912

CRITICAL CVSS 9.80 EPSS Score 0.09 EPSS Percentile 39.23

Remote Code Execution

Published: June 14, 2024

Certain models of ASUS routers have an arbitrary firmware upload vulnerability. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands on the device.

Quotes

• Certain ASUS router models have authentication bypass vulnerability, allowing unauthenticated remote attackers to log in the device

Headlines

• June 17, 2024 - ASUS Patches Critical Authentication Bypass Flaw in Multiple Router Models
• June 17, 2024 - Critical Security Vulnerability CVE-2024-3912 Hits ASUS Routers
• June 16, 2024 - ASUS fixed critical remote authentication bypass bug in several routers
• June 15, 2024 - ASUS warns of critical remote authentication bypass on 7 routers

CVE-2024-3080

CRITICAL CVSS 9.80 EPSS Score 0.09 EPSS Percentile 39.23

Risk Context N/A

Published: June 14, 2024

Certain ASUS router models have authentication bypass vulnerability, allowing unauthenticated remote attackers to log in the device.

Quotes

• Certain ASUS router models have authentication bypass vulnerability, allowing unauthenticated remote attackers to log in the device

Headlines

• June 17, 2024 - ASUS Patches Critical Authentication Bypass Flaw in Multiple Router Models
• June 16, 2024 - ASUS Issues Critical Security Update for Router Vulnerability CVE-2024-3080 (CVSS 9.8)
• June 16, 2024 - ASUS fixed critical remote authentication bypass bug in several routers
• June 15, 2024 - ASUS warns of critical remote authentication bypass on 7 routers

CVE-2023-34048

CRITICAL CVSS 9.80 EPSS Score 4.38 EPSS Percentile 92.44

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: Oct. 25, 2023

vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution.

Vendor Impacted: Vmware

Product Impacted: Vcenter Server

Headlines

• June 20, 2024 - China-Linked UNC3886: Mandiant Reveals Extensive Espionage TTPs
• June 18, 2024 - Cloaked and Covert: Uncovering UNC3886 Espionage Operations | Google Cloud Blog
• June 18, 2024 - VMware Issues Patches for Cloud Foundation, vCenter Server, and vSphere ESXi

CVE-2022-42475

CRITICAL CVSS 9.80 EPSS Score 32.12 EPSS Percentile 97.04

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: Jan. 2, 2023

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.

Vendor Impacted: Fortinet

Products Impacted: Fortigate-6501f-Dc, Fortigate-6300f, Fortigate-6300f-Dc, Fpm-7620f, Fim-7920e, Fortigate-6500f-Dc, Fim-7941f, Fortiproxy, Fortigate-6500f, Fim-7904e, Fortigate-6601f-Dc, Fpm-7620e, Fortigate-7030e, Fortigate-6601f, Fortigate-7121f, Fortigate-7040e, Fim-7921f, Fortigate-6501f, Fim-7910e, Fortios, Fortigate-7060e, Fim-7901e, Fpm-7630e

Quotes

• Running tabletop simulation or wargaming exercises
• Persistence mechanisms encompassed network devices, hypervisors, and virtual machines, ensuring alternative channels remain available even if the primary layer is detected and eliminated

Headlines

• June 20, 2024 - Tabletop exercises are headed to the next frontier: Space
• June 19, 2024 - Chinese Cyber Espionage Group Exploits Fortinet and VMware Zero-Days
• June 18, 2024 - Cloaked and Covert: Uncovering UNC3886 Espionage Operations | Google Cloud Blog

CVE-2024-37081

HIGH CVSS 7.80 EPSS Score 0.04 EPSS Percentile 9.04

Risk Context N/A

Published: June 18, 2024

The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user with non-administrative privileges may exploit these issues to elevate privileges to root on vCenter Server Appliance.

Quotes

• Heap-overflow vulnerabilities in the implementation of the DCE/RPC protocol
• The increasing popularity of cloud computing has led to a corresponding surge in VM usage, consolidating multiple applications onto a single physical server
• A malicious actor with network access to vCenter Server may trigger these vulnerabilities by sending a specially crafted network packet potentially leading to remote code execution
• There may be other mitigations and compensating controls available in your organization, depending on your security posture, defense-in-depth strategies, and configurations of perimeter firewalls and appliance firewalls. All organizations must decide for themselves whether to rely on those protections

Headlines

• June 18, 2024 - Critical VMware Bugs Open Swaths of VMs to RCE, Data Theft
• June 18, 2024 - VMware fixes critical vCenter RCE vulnerability, patch now
• June 18, 2024 - VMware fixed RCE and privilege escalation bugs in vCenter Server
• June 18, 2024 - VMware Discloses Critical Vulnerabilities, Urges Immediate Remediation
• June 18, 2024 - Critical RCE flaws in vCenter Server fixed (CVE-2024-37079, CVE-2024-37080)
• June 18, 2024 - VMware Issues Patches for Cloud Foundation, vCenter Server, and vSphere ESXi
• June 18, 2024 - VMware by Broadcom warns of critical vCenter flaws
• June 18, 2024 - CVE-2024-37079, CVE-2024-37080: Critical VMware vCenter Server Vulnerabilities Demand Immediate Action

CVE-2022-0847

HIGH CVSS 7.80 EPSS Score 7.58 EPSS Percentile 94.16

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: March 10, 2022

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.

Vendors Impacted: Netapp, Siemens, Redhat, Ovirt, Linux, Sonicwall, Fedoraproject

Products Impacted: H300s Firmware, H300e, H500s Firmware, Enterprise Linux For Ibm Z Systems Eus, Linux Kernel, Enterprise Linux For Real Time Tus, Kernel, Fedora, H700s, Ovirt-Engine, H410c Firmware, H500s, Enterprise Linux Server Aus, Enterprise Linux For Real Time For Nfv, H500e, H300e Firmware, Enterprise Linux For Power Little Endian, H700e, H700s Firmware, Enterprise Linux For Ibm Z Systems, Enterprise Linux For Real Time, Enterprise Linux Server Tus, Enterprise Linux For Real Time For Nfv Tus, Enterprise Linux Server For Power Little Endian Update Services , H410s, Enterprise Linux Eus, Sma1000 Firmware, Codeready Linux Builder, H410c, Scalance Lpe9403 Firmware, H500e Firmware, Scalance Lpe9403, H410s Firmware, Enterprise Linux Server Update Services For Sap Solutions, Sma1000, Enterprise Linux For Power Little Endian Eus, Virtualization Host, H300s, H700e Firmware, Enterprise Linux

Quotes

• It is possible some of the customizations made by UTA0137 may help bypass certain detections
• It is a modified version of the public project Discord-C2, which uses the messaging service Discord for command and control (C2), making use of emojis for its C2 communication

Headlines

• June 17, 2024 - Emojis Control the Malware in Discord Spy Campaign
• June 17, 2024 - Linux Malware DISGOMOJI Targets Indian Officials
• June 15, 2024 - Pakistani Hackers Use DISGOMOJI Malware in Indian Government Cyber Attacks

CVE-2024-0762

HIGH CVSS 7.50 EPSS Score 0.04 EPSS Percentile 9.04

Actively Exploited

Published: May 14, 2024

Potential buffer overflow in unsafe UEFI variable handling in Phoenix SecureCore™ for select Intel platforms This issue affects: Phoenix SecureCore™ for Intel Kaby Lake: from 4.0.1.1 before 4.0.1.998; Phoenix SecureCore™ for Intel Coffee Lake: from 4.1.0.1 before 4.1.0.562; Phoenix SecureCore™ for Intel Ice Lake: from 4.2.0.1 before 4.2.0.323; Phoenix SecureCore™ for Intel Comet Lake: from 4.2.1.1 before 4.2.1.287; Phoenix SecureCore™ for Intel Tiger Lake: from 4.3.0.1 before 4.3.0.236; Phoenix SecureCore™ for Intel Jasper Lake: from 4.3.1.1 before 4.3.1.184; Phoenix SecureCore™ for Intel Alder Lake: from 4.4.0.1 before 4.4.0.269; Phoenix SecureCore™ for Intel Raptor Lake: from 4.5.0.1 before 4.5.0.218; Phoenix SecureCore™ for Intel Meteor Lake: from 4.5.1.1 before 4.5.1.15.

Quotes

• It's not not really the greatest place to hack into, but it is a really good place to set up shop
• The vulnerability allows a local attacker to escalate privileges and gain code execution within the UEFI firmware during runtime
• This type of low-level exploitation is typical of firmware backdoors (e.g., BlackLotus) that are increasingly observed in the wild
• The issue involves an unsafe variable in the Trusted Platform Module (TPM) configuration that could lead to a buffer overflow and potential malicious code execution
• These are Intel codenames for multiple generations of Intel Core mobile and desktop processors. Given that these Intel Core processors are used by a wide range of OEMs and ODMs, the same vulnerability could potentially affect a wide range of vendors and potentially hundreds of PC products that also use the Phoenix SecureCore UEFI firmware

Headlines

• June 21, 2024 - UEFICANHAZBUFFEROVERFLOW flaw in the Phoenix SecureCore UEFI firmware potentially impacts hundreds of PC and server models
• June 21, 2024 - Intel-powered computers affected by serious firmware flaw (CVE-2024-0762)
• June 20, 2024 - Phoenix UEFI vulnerability impacts hundreds of Intel PC models
• June 20, 2024 - High-Risk Overflow Bug in Intel Chips Likely Impacts 100s of PC Models
• June 20, 2024 - Researchers Uncover UEFI Vulnerability Affecting Multiple Intel CPUs

CVE-2024-3079

HIGH CVSS 7.20 EPSS Score 0.04 EPSS Percentile 9.04

Risk Context N/A

Published: June 14, 2024

Certain models of ASUS routers have buffer overflow vulnerabilities, allowing remote attackers with administrative privileges to execute arbitrary commands on the device.

Quotes

• Certain ASUS router models have authentication bypass vulnerability, allowing unauthenticated remote attackers to log in the device

Headlines

• June 17, 2024 - ASUS Patches Critical Authentication Bypass Flaw in Multiple Router Models
• June 16, 2024 - ASUS Issues Critical Security Update for Router Vulnerability CVE-2024-3080 (CVSS 9.8)
• June 15, 2024 - ASUS warns of critical remote authentication bypass on 7 routers