CVE-2024-37079: Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability

Broadcom VMware vCenter Server contains an out-of-bounds write vulnerability in its DCERPC protocol implementation. An attacker with network access can send specially crafted packets that may result in remote code execution on the server.

This matters because vCenter Server manages virtual infrastructure; successful exploitation can give an attacker control over the management plane without requiring prior credentials.

How it works

The weakness is classified as CWE-787, an out-of-bounds write. In this class of flaw, a program writes data beyond the allocated boundaries of a buffer, which can corrupt adjacent memory and allow arbitrary code execution.

• An attacker must have network connectivity to the vCenter Server instance.
• The attacker supplies malformed DCERPC packets that trigger the write outside expected bounds.
• Successful abuse can lead to remote code execution on the affected server.

Am I affected? How to find it in your systems

Inventory all deployments of Broadcom VMware vCenter Server in your environment. Confirm the exact versions and configurations running in production, test, and disaster-recovery sites.

• Locate vCenter Server instances through asset-management tools, hypervisor host inventories, or network discovery of management ports.
• Compare installed builds against the vendor advisory to determine whether the DCERPC implementation is vulnerable.
• Review firewall rules and network segmentation to identify any external or internal paths that allow unauthenticated or low-privileged access to vCenter.
• Monitor DCERPC-related traffic and authentication logs for anomalous packet sizes or malformed requests that deviate from normal administrative activity.

How to remediate

Apply the vendor-supplied update referenced in the official advisory. This is the primary and most effective control.

• After patching, validate that the update has been applied across all vCenter instances, including those in linked or federated deployments.
• Restrict network access to vCenter management interfaces to only the minimum set of administrative hosts required for operations.
• Review DCERPC-related services and disable any unnecessary protocol features if permitted by the vendor configuration guidance.

If you can't patch immediately

Until the update can be deployed, reduce exposure through network controls and monitoring.

• Place vCenter Server behind strict network segmentation so that only trusted management networks can reach its DCERPC ports.
• Implement compensating controls such as virtual patching or protocol-aware filtering at network boundaries where technically feasible.
• Disable or tightly restrict the affected DCERPC functionality if the vendor provides an option to do so without breaking core operations.
• Increase logging and alerting on vCenter authentication events and unusual network traffic to the server.

If your data may have been exposed

Actively exploited vulnerabilities of this type can lead to unauthorized access and data exposure. Organizations can run a free exposure scan of their email domains against known breach data to check for prior incidents involving their accounts.