CVE DatabaseCVE-2023-34048

Updated 2026-06-17한국어 권고문 →

CVE-2023-340489.8/CRITICALCISA KEVCWE-787CWE-787

VMware vCenter Server DCERPC Protocol Out-of-Bounds Write Vulnerability (CVE-2023-34048) Security Advisory

⚡ Jump to Patch

Affected Vendors

vmware

Affected Components

vcenter_server, cloud_foundation

Published Date

2023-10-25

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

99.2%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

VMware vCenter Server 7.0 and 8.0 series, VMware Cloud Foundation 4.x and 5.x series

Impact

An unauthenticated attacker with network access can trigger an out-of-bounds write, potentially leading to remote code execution (RCE) with administrative privileges

Mitigation

Apply the official security patches immediately, and restrict network access to the vCenter DCERPC port (default 2012/tcp) using firewalls

Affected Products & Version Scope

VMware vCenter Server 8.0 (prior to 8.0U2), vCenter Server 7.0 (prior to 7.0U3o), VMware Cloud Foundation 5.x and 4.x

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

VMware has released official patches to address this vulnerability. Administrators should upgrade vCenter Server to 8.0 Update 2b (or later) or 7.0 Update 3p (or later). Use the following commands in the vCenter Server Appliance (VCSA) shell to apply updates:

bash

# List available software updates
software-packages llist --updates

# Install and apply the latest updates from the repository
software-packages install --url --acceptEEULA

2. Temporary Workaround & Hardening Configuration

If immediate patching is not feasible, restrict network access to the DCERPC port (default TCP port 2012) using network firewalls or local iptables rules to limit exposure to trusted administrative subnets only.

bash

# Allow access to port 2012 only from a trusted management subnet (e.g., 10.0.0.0/24)
iptables -A INPUT -p tcp -s 10.0.0.0/24 --dport 2012 -j ACCEPT

# Drop all other incoming traffic to port 2012
iptables -A INPUT -p tcp --dport 2012 -j DROP

3. Log Audit & IoC Verification Commands

Verify the current vCenter Server version and inspect system logs for potential exploitation attempts, service crashes, or segmentation faults related to the DCERPC service.

bash

# Check the current vCenter Server build version
vpxd -v

# Search for segmentation faults or out-of-bounds errors in system logs
grep -Ei 'segfault|general protection|out of bounds' /var/log/messages
grep -Ei 'fail|crash|exception' /var/log/vmware/vmdird/vmdird-syslog.log

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

Datadog Cloud & Kubernetes Security

Due to active exploitation in the wild (CISA KEV listed), prioritize and apply the official VMware security patches immediately.

Detect Container Escape & Privilege Escalation Across Your Kubernetes Fleet

Continuous eBPF-based runtime threat detection and posture management for AWS, GCP, Azure, Docker, and Kubernetes workloads.

Real-Time Production Container CVE Mapping

Start 14-Day Free Cloud Security Trial

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2023-34048) is an out-of-bounds write (CWE-787) vulnerability residing in the implementation of the Distributed Computing Environment / Remote Procedure Calls (DCERPC) protocol within VMware vCenter Server. The root cause is insufficient validation of network-facing DCERPC packets, allowing an attacker to write data beyond the allocated buffer boundaries in memory.

2. Exploitation Mechanics & Attack Scenario

A remote attacker can exploit this vulnerability by sending specially crafted RPC packets to the DCERPC service port (typically TCP port 2012) on an affected vCenter Server. Because the vulnerability occurs prior to authentication, no credentials or user interaction are required. The out-of-bounds write corrupts critical memory structures (such as heap metadata or function pointers), enabling the attacker to hijack the execution flow and execute arbitrary code in the context of the vulnerable process.

3. Infrastructure & Business Impact

vCenter Server serves as the centralized management plane for entire virtualized infrastructures, including ESXi hosts, virtual machines, and storage networks. Successful exploitation of this vulnerability grants the attacker full control over the vCenter Server. This allows them to compromise all managed virtual machines, deploy ransomware, exfiltrate sensitive data, and cause catastrophic disruption to business operations.

Official Vendor Advisories & References

NVD Original English Description

vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution.

https://www.vmware.com/security/advisories/VMSA-2023-0023.html

Source: security@vmware.com · Vendor Advisory

https://www.vicarius.io/vsociety/posts/understanding-cve-2023-34048-a-zero-day-out-of-bound-write-in-vcenter-server

Source: af854a3a-2127-422b-91ae-364da2661108 · Exploit, Third Party Advisory

https://www.vmware.com/security/advisories/VMSA-2023-0023.html

Source: af854a3a-2127-422b-91ae-364da2661108 · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-34048

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2023-34048)

FAQ

Q1. How critical is CVE-2023-34048 and is it actively exploited in the wild?

CVE-2023-34048 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 99.2%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2023-34048?

Primary impacted vendors include vmware across vcenter_server, cloud_foundation. Scope summary: VMware vCenter Server 8.0 (prior to 8.0U2), vCenter Server 7.0 (prior to 7.0U3o), VMware Cloud Foundation 5.x and 4.x

Q3. What temporary mitigations or workarounds exist for CVE-2023-34048 before patching?

[Mitigation] Apply the official security patches immediately, and restrict network access to the vCenter DCERPC port (default 2012/tcp) using firewalls Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION