top of page
Search

CVE-2024-37079 "vCenter DCERPC Overflow"

DTG Threat Management Team
Feb 2
6 min read

Pegasos24/7 Threat Labs Advisory

Classification

Threat Advisory

Threat Level

Critical

Date Issued

18 June 2024

Distribution

To: Security Operations Centers (SOC), Virtualization Teams, Infrastructure Teams, Cloud Operations

Executive Summary

CVE-2024-37079, a critical (CVSS 9.8) heap-based buffer overflow vulnerability in VMware vCenter Server, permits unauthenticated remote attackers with network access to execute arbitrary code with root privileges. The vulnerability exists in the DCERPC protocol implementation within libdcerpc.so, affecting services on TCP ports 2012, 2014, and 2020.

Exploitation is confirmed in the wild. CISA added CVE-2024-37079 to the Known Exploited Vulnerabilities (KEV) catalog on January 23, 2026, with a federal remediation deadline of February 13, 2026. At least three public proof-of-concept exploits are available on GitHub. VMware states there are no workarounds and patching is mandatory.

vCenter Server is the centralized management plane for VMware vSphere environments. Compromise provides attackers "keys to the kingdom", control over all managed ESXi hosts and virtual machines, enabling data exfiltration, ransomware deployment, or persistent hypervisor-level backdoors.

The Vulnerability

CVE-2024-37079 is classified under CWE-787 (Out-of-bounds Write) and CWE-122 (Heap-based Buffer Overflow). The vulnerability stems from an integer underflow in VMware vCenter Server's DCERPC protocol implementation, specifically within the libdcerpc.so library derived from the Likewise Open project.

When processing Bind Acknowledgement (type 0x0c) or Alter Context Response (type 0x0f) packets containing a Presentation Context List with 169 or more elements, an integer underflow occurs in the response header size calculation. This causes undersized heap allocation followed by overflow when copying data. The vulnerable DCERPC services (vmcad, vmdird, and vmafdd) are network-accessible without authentication.

 

Attribute

Detail

CVE ID

CVE-2024-37079

Companion CVE

CVE-2024-37080 (CVSS 9.8, same root cause), CVE-2024-37081 (CVSS 7.8, sudo privesc)

Nickname

 

Attack Vector

Network (unauthenticated)

CVSS v3.1 Score

9.8 (Critical)

CVSS v4.0 Score

9.8 (Critical)

Attack Complexity

Low

CWE

CWE-787 (Out-of-bounds Write), CWE-122 (Heap Buffer Overflow)

Vulnerable Component

libdcerpc.so (Likewise Open fork) (vmcad, vmdird, vmafdd services)

Exploit Availability

Public PoCs on GitHub (3+ repositories)

Exploitation Status

Actively exploited (CISA KEV January 23, 2026)

Vendor Advisory

VMSA-2024-0012

Technical Details

  • Root Cause: The libdcerpc.so library fails to validate the Presentation Context List element count. When 169+ elements are present, size calculation underflows, causing small heap allocation followed by large memcpy.

  • Attack Vector: Network access to TCP ports 2012, 2014, or 2020 (vmcad, vmdird, vmafdd services). No authentication required. Attacker sends crafted DCERPC packets to trigger the overflow.

  • Impact: Arbitrary code execution with root privileges on vCenter Server appliance. Full control of virtualization management plane. Lateral movement to all ESXi hosts. Access to all VM disks, memory, and network traffic.

Affected Software and Version

  • vCenter Server 8.0 — Affected through 8.0 U2c; patched in 8.0 Update 2d

  • vCenter Server 8.0 U1 — Affected through 8.0 U1d; patched in 8.0 Update 1e

  • vCenter Server 7.0 — Affected through 7.0 U3q; patched in 7.0 Update 3r

  • VMware Cloud Foundation — Async patched via KB 88287

Not Affected: VMware vSphere Client, ESXi standalone (only when managed by vulnerable vCenter).

Critical: VMware has stated there are no workarounds available. Patching is the only mitigation.


Threat Intelligence

Threat Actors

Actor

Attribution

Targets

Payload

Status

UNC3886

China — State-sponsored

Exploited CVE-2023-34048 (vCenter DCERPC) for 1.5 years undetected

Likely active

UNC3886

Fire Ant / Warp Panda

China — APT clusters

Sustained interest in VMware virtualization infrastructure

Monitoring

Fire Ant / Warp Panda

Victimology & Targeting

  • Government and defense agencies (primary targets for Chinese APTs)

  • Financial services institutions with virtualized trading/processing infrastructure

  • Healthcare organizations with VMware-based EHR systems

  • Technology companies with large VMware deployments

  • Any organization with vCenter exposed to untrusted networks or internet


MITRE ATT&CK Alignment

Technique ID

Name

Context

T1190

Exploit Public-Facing Application

Initial access via vulnerable vCenter DCERPC

T1059

Command and Scripting Interpreter

Post-exploitation command execution

T1078

Valid Accounts

Credential harvesting post-compromise

T1003

OS Credential Dumping

vCenter stores ESXi/AD credentials

T1021

Remote Services

Lateral movement to ESXi hosts

T1485

Data Destruction

Ransomware deployment across VMs

 

Exploitation Indicators & IOCs

Network Indicators

  • Connections to TCP ports 2012, 2014, or 2020 from external/unexpected internal sources

  • DCERPC Bind Acknowledgement packets (type 0x0c) with 169+ Presentation Context elements

  • DCERPC Alter Context Response packets (type 0x0f) with malformed payloads

  • Unexpected outbound connections from vCenter Server post-exploitation

Log Indicators

  • vCenter Server crash logs indicating heap corruption in DCERPC services

  • VMware vpxd service failures or unexpected restarts

  • Authentication anomalies in vmdird logs

  • New administrative accounts created in vSphere without change requests

  • ESXi host SSH access from vCenter following unusual vCenter activity

Detection Rules

No public Snort/Suricata/YARA rules currently available. Custom detection recommended:

  • Alert on connections to TCP 2012/2014/2020 from non-management subnets

  • Alert on high-frequency connection attempts to vCenter DCERPC services

  • Monitor for DCERPC packets exceeding normal size thresholds

  • Alert on vCenter appliance spawning unexpected child processes

Threat Landscape and Observed Exploitation

Active exploitation was confirmed when CISA added CVE-2024-37079 to the KEV catalog on January 23, 2026, with remediation deadline February 13, 2026 for federal agencies. This indicates threat actors have successfully weaponized the vulnerability against production environments.

The vulnerability was discovered by Hao Zheng and Zibo Li of QiAnXin LegendSec TianGong Team, with additional credit to Matei "Mal" Badanoiu of Deloitte Romania. Technical details were presented at Black Hat Asia 2025. At least three proof-of-concept exploits are publicly available on GitHub.

Historical context: UNC3886 previously exploited CVE-2023-34048 (another vCenter DCERPC vulnerability) for approximately 1.5 years before detection, demonstrating that sophisticated actors prioritize VMware infrastructure for persistent access.

Detection and Forensics

  • Log Review: Examine /var/log/vmware/vpxd/vpxd.log for service crashes. Check /var/log/vmware/vmcad/ and /var/log/vmware/vmdird/ for DCERPC anomalies.

  • Memory Analysis: Memory dumps of vmcad, vmdird, vmafdd processes may reveal shellcode. Look for injected code in DCERPC service memory.

  • Network Forensics: Capture PCAP on ports 2012/2014/2020. Analyze for DCERPC packets with 169+ Presentation Context elements.

  • Hunting Guidance: Query SIEM for historical vCenter DCERPC port connections. Audit vSphere admin actions since June 2024 (original patch date).

  • Forensic Tools: Velociraptor, KAPE for vCenter appliance triage. ESXi shell history review for lateral movement indicators.


Business Impact

Critical Infrastructure at Risk

VMware vCenter Server manages the virtualization layer underpinning most enterprise data centers. Compromise enables attackers to access, modify, or destroy any virtual machine (e.g., databases, domain controllers, file servers, applications) in the environment.

CIA Triad Impact

  • Confidentiality: All VM data accessible (e.g., disk images, memory, network traffic). Includes databases, credentials, email, strategic documents.

  • Integrity: VM configurations modifiable. Boot images can be altered. Backdoors deployed at hypervisor level survive VM reinstalls.

  • Availability: Ransomware deployable across entire virtualized infrastructure. Mass VM deletion. ESXi host lockout.

  • Downstream Risk: ESXi host compromise. VM escape scenarios. Credential harvesting enables broader network compromise.


Mitigation and Response Actions

Immediate (Day 1)

  1. Identify all vCenter Server instances and determine patch levels.

  2. Apply patches: vCenter 7.0 U3r, 8.0 U1e, or 8.0 U2d. No workarounds exist.

  3. Restrict network access to TCP ports 2012, 2014, 2020 to management networks only.

  4. Review vCenter logs for exploitation indicators since June 2024.

Short-Term (Days 2-7)

  1. Network segmentation: Isolate vCenter from general user networks.

  2. Enhanced logging: Enable SIEM integration for vCenter services.

  3. Account audit: Review vSphere administrative accounts; remove unauthorized.

  4. Deploy network detection for anomalous DCERPC traffic.

  5. Threat hunt for historical exploitation indicators.

Long-Term (Ongoing)

  1. Patch management SLA: 72-hour maximum for Critical virtualization CVEs.

  2. Zero-trust architecture for management plane access.

  3. EDR/XDR deployment with vCenter appliance visibility.

  4. Regular penetration testing of virtualization management interfaces.

  5. Offline backups of vCenter configuration for recovery.


DTG Recommendations

Restrict Exposure

  • Ensure vCenter is not internet-accessible.

  • Firewall rules limiting DCERPC ports (2012, 2014, 2020) to management Ips.

  • VPN or jump host requirements for administrative access.

  • Block vCenter management from user VLANs.

Apply Patches

  • Update to vCenter 7.0 U3r, 8.0 U1e, or 8.0 U2d immediately.

  • No workarounds. Patching is the only remediation.

  • VMware Cloud Foundation: Apply async patch per KB 88287.

  • Test patches in non-production before production rollout.

Monitor for Compromise

  • Monitor TCP 2012/2014/2020 for unexpected connections.

  • Alert on vCenter service crashes or restarts.

  • Review vSphere audit logs for unauthorized admin actions.

  • Track ESXi SSH access patterns post-vCenter authentication.

Incident Response

  • If exploitation suspected, isolate vCenter immediately.

  • Preserve memory dumps and logs before remediation.

  • Engage forensics to determine compromise scope.

  • Assume all managed ESXi hosts and VMs may be affected.

Network Segmentation and Hardening

  • Dedicated management VLAN for vCenter with strict ACLs.

  • Microsegmentation for east-west vCenter traffic.

  • Disable unnecessary services on vCenter appliance.

  • Enable vCenter appliance firewall (VAMI).


Call to Action and References

Call to Action

DTG’s Incident Response and Threat Management teams continue tracking this activity across monitored customer environments. Clients using DTG Wirespeed or Pegasos platforms can request an immediate authentication telemetry review or targeted compromise assessment through standard DTG support channels.

Don’t wait for an attack - reach out to DTG today to ensure your organization is protected.


References

1. NIST NVD -- "CVE-2024-37079" https://nvd.nist.gov/vuln/detail/cve-2024-37079

3. VMware Core -- "VMSA-2024-0012 Questions & Answers" https://core.vmware.com/resource/vmsa-2024-0012-questions-answers

4. CISA Alert -- "One Known Exploited Vulnerability Added (January 23, 2026)" https://www.cisa.gov/news-events/alerts/2026/01/23/cisa-adds-one-known-exploited-vulnerability-catalog

5. CISA KEV Catalog -- "CVE-2024-37079" https://www.cisa.gov/known-exploited-vulnerabilities-catalog

9. Arctic Wolf -- "CVE-2024-37079 & CVE-2024-37080" https://arcticwolf.com/resources/blog/cve-2024-37079-cve-2024-37080/

10. Mandiant -- "UNC3886 vCenter Exploitation History" https://www.mandiant.com/resources/blog/unc3886-vmware-vcenter-exploitation

11. Lumifi Cyber -- "VMware vCenter Heap Overflow Analysis" https://www.lumificyber.com/threat-library/cve-2024-37079-37080-37081/

12. CVE Details -- "CVE-2024-37079" https://www.cvedetails.com/cve/CVE-2024-37079/

13. MITRE ATT&CK -- "Technique Reference" https://attack.mitre.org/

Comments

bottom of page