Critical Out-of-Bounds Write in Broadcom VMware vCenter Server (CVE-2024-37079) Enables Remote Code Execution
What It Is — Broadcom VMware vCenter Server contains an out‑of‑bounds write flaw in its DCERPC implementation. An attacker who can reach the vCenter service on the network can craft malicious DCERPC packets that trigger the write, leading to remote code execution.
Exploitability — No public exploit code has been released, but the vulnerability is network‑accessible and scores 9.8 (CVSS v3.1), classifying it as critical.
Affected Products — All Broadcom‑branded VMware vCenter Server releases that have not yet applied the vendor‑issued patch (see Broadcom advisory for exact version range).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous vulnerability monitoring to satisfy the patch management control objective that underpins many frameworks (e.g., NIST CSF 2.0 Identify‑Protect).
- Provides a concrete audit‑ready evidence point: timely detection, remediation, and documentation of the fix become part of a defensible control evidence set.
- Highlights that network‑level segmentation and strict access controls are essential to limit exposure of critical management planes.
Recommended Actions
- Apply the Broadcom‑issued security patch immediately.
- Verify patch deployment through an authenticated scan of all vCenter instances.
- Update your vulnerability‑management tooling to flag CVE‑2024‑37079 as high priority.
- Document the remediation workflow in your control evidence repository to support audit readiness.
Source: CISA KEV – CVE‑2024‑37079