VMware vCenter Server 7

Tenable plugin 207464 maps to Broadcom advisory VMSA-2024-0019 and really means two bugs in VMware vCenter Server: CVE-2024-38812, an unauthenticated DCERPC heap overflow that can lead to remote code execution, and CVE-2024-38813, a privilege-escalation flaw that can push access to root. Affected versions are vCenter 7.0 before 7.0 U3t and vCenter 8.0 before the fixed trains 8.0 U2e or 8.0 U3d; the concrete safe builds are 7.0.3.02200 build 24322018, 8.0.2.00500 build 24321653, and 8.0.3.00400 build 24322831.

Vendor CRITICAL is technically defensible for the RCE half, but it slightly overstates real-world population risk because exploitation is only possible where an attacker can actually talk to vCenter's management/DCERPC surface. That reachability requirement is real friction in mature enterprises, so this lands as HIGH, not CRITICAL; the score stays near the ceiling because the issue is unauthenticated, KEV-listed, actively exploited, and hits the virtualization control plane.

Why this verdict

• Start at vendor 9.8 because CVE-2024-38812 is unauthenticated network RCE on a crown-jewel management server.
• Adjust downward for attacker position because the bug is only valuable where the attacker can reach vCenter's management plane and, in practice, the relevant DCERPC service. That usually implies internet exposure or post-initial-access movement into admin or management segments, which shrinks the reachable population versus true edge software.
• Adjust upward again for exploitation evidence and blast radius because both CVEs hit KEV on 2024-11-20, Broadcom confirmed in-the-wild exploitation for CVE-2024-38813, and owning vCenter means owning the orchestration layer for many ESXi hosts and VMs.

Why not higher?

This is not a universal internet worm problem. Many enterprises keep vCenter off the public internet, restrict it to jump hosts, and will be flagged by version-based scanning even when the exact exploitable DCERPC path is not broadly reachable. That real-world reachability friction is enough to keep it out of CRITICAL.

Why not lower?

Once reachable, the primary flaw needs no authentication and the impact is not 'one server down' but potential compromise of the virtualization control plane. KEV status and confirmed in-the-wild exploitation remove any comfort that this is just a hard-to-use lab bug.

1. Restrict vCenter reachability now — Limit 443, 5480, and any management/DCERPC-relevant paths to dedicated admin jump hosts and management networks only. Because this issue is KEV-listed, apply this immediately, within hours, not on the normal HIGH cadence.
2. Block direct internet exposure — If any vCenter UI or VAMI is externally reachable, remove it from direct internet access and force administration through VPN plus bastion or ZTNA. For this KEV case, do it immediately, within hours.
3. Monitor vCenter for abnormal API and root activity — Push vCenter audit logs, shell logs, and network telemetry into SIEM and alert on unusual VM operations, privilege changes, new services, and unexpected outbound connections from the appliance. Stand this up immediately, within hours where patching cannot be completed at once.
4. Validate the October 21 fixed build — Do not assume the September 17 patch closed the hole; Broadcom explicitly said it was incomplete for CVE-2024-38812. Confirm each appliance is on 7.0 U3t, 8.0 U2e, 8.0 U3d, or later immediately, within hours.

Run this on each vCenter Server Appliance over SSH as root or an account with shell access to execute vpxd -v. Save it as check_vmsa_2024_0019.sh, then run bash check_vmsa_2024_0019.sh; it needs local shell access but no internet connectivity.

#!/usr/bin/env bash
# check_vmsa_2024_0019.sh
# Detects whether a VMware vCenter Server Appliance is vulnerable to VMSA-2024-0019
# Covers CVE-2024-38812 / CVE-2024-38813 fixed in:
#   7.0 U3t  -> 7.0.3.02200 build 24322018
#   8.0 U2e  -> 8.0.2.00500 build 24321653
#   8.0 U3d  -> 8.0.3.00400 build 24322831
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

SAFE_BUILD_7_0_U3T=24322018
SAFE_BUILD_8_0_U2E=24321653
SAFE_BUILD_8_0_U3D=24322831

get_version_output() {
  if command -v vpxd >/dev/null 2>&1; then
    vpxd -v 2>/dev/null | head -n 1
    return 0
  fi

  if [[ -r /var/log/vmware/vpxd/vpxd.log ]]; then
    grep -m1 -E 'VMware VirtualCenter|build-' /var/log/vmware/vpxd/vpxd.log 2>/dev/null
    return 0
  fi

  return 1
}

parse_version() {
  local line="$1"
  VERSION=$(echo "$line" | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+' | head -n1)
  BUILD=$(echo "$line" | grep -Eo 'build-?[0-9]+' | grep -Eo '[0-9]+' | head -n1)
}

version_ge() {
  # returns 0 if $1 >= $2
  local a="$1" b="$2"
  local IFS=.
  local i
  read -r -a va <<< "$a"
  read -r -a vb <<< "$b"
  for ((i=${#va[@]}; i<3; i++)); do va[i]=0; done
  for ((i=${#vb[@]}; i<3; i++)); do vb[i]=0; done
  for i in 0 1 2; do
    if ((10#${va[i]} > 10#${vb[i]})); then return 0; fi
    if ((10#${va[i]} < 10#${vb[i]})); then return 1; fi
  done
  return 0
}

line="$(get_version_output)"
if [[ -z "${line:-}" ]]; then
  echo "UNKNOWN: could not determine vCenter version/build (vpxd unavailable)"
  exit 2
fi

parse_version "$line"
if [[ -z "${VERSION:-}" || -z "${BUILD:-}" ]]; then
  echo "UNKNOWN: unable to parse version/build from: $line"
  exit 2
fi

major_minor=$(echo "$VERSION" | awk -F. '{print $1"."$2}')

echo "Detected version=$VERSION build=$BUILD"

case "$major_minor" in
  7.0)
    # Future 7.0.4+ style versions do not exist for vCenter; build threshold is safest.
    if (( BUILD >= SAFE_BUILD_7_0_U3T )); then
      echo "PATCHED"
      exit 0
    else
      echo "VULNERABLE"
      exit 1
    fi
    ;;
  8.0)
    # First handle clearly newer minor/update trains.
    if version_ge "$VERSION" "8.0.4"; then
      echo "PATCHED"
      exit 0
    fi

    if version_ge "$VERSION" "8.0.3"; then
      if (( BUILD >= SAFE_BUILD_8_0_U3D )); then
        echo "PATCHED"
        exit 0
      else
        echo "VULNERABLE"
        exit 1
      fi
    fi

    if version_ge "$VERSION" "8.0.2"; then
      if (( BUILD >= SAFE_BUILD_8_0_U2E )); then
        echo "PATCHED"
        exit 0
      else
        echo "VULNERABLE"
        exit 1
      fi
    fi

    echo "VULNERABLE"
    exit 1
    ;;
  *)
    echo "UNKNOWN: unsupported or unexpected vCenter version family '$major_minor'"
    exit 2
    ;;
esac

Sources

1. Tenable Nessus Plugin 207464
2. Broadcom VMSA-2024-0019.3 advisory
3. Broadcom vCenter versions and build numbers KB 326316
4. NVD CVE-2024-38812
5. NVD CVE-2024-38813
6. Shadowserver Vulnerable HTTP Report
7. Censys advisory for CVE-2024-38812/38813
8. BleepingComputer on incomplete first patch