CVE-2023-34048
VMware vCenter Server Out-of-Bounds Write Vulnerability
Description
CVE-2023-34048 is a critical out-of-bounds write vulnerability (CWE-787) in VMware vCenter Server, specifically within the server's implementation of the DCERPC protocol. A malicious actor with network access to the vCenter Server can exploit this flaw to trigger an out-of-bounds write, potentially leading to remote code execution with no authentication required. The vulnerability carries a maximum CVSS score of 9.8 (CRITICAL) and has been confirmed as actively exploited in the wild by CISA, which added CVE-2023-34048 to its Known Exploited Vulnerabilities catalog. With an EPSS score of 93.1% (99.8th percentile), this vulnerability is being actively targeted and demands immediate patching across all affected VMware vCenter Server deployments.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| vmware | vcenter server | >= 4.0, <= 5.5; 7.0; 8.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.vmware.com/security/advisories/VMSA-2023-0023.html(Vendor Advisory)
- https://www.vicarius.io/vsociety/posts/understanding-cve-2023-34048-a-zero-day-out-of-bound-write-in-vcenter-server(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-34048(US Government Resource)
Weakness Type
CWE-787: Out-of-Bounds Write
CVE-2023-34048 is rooted in an out-of-bounds write weakness (CWE-787) in VMware vCenter Server's DCERPC protocol handler. An out-of-bounds write occurs when software writes data to a memory location outside the bounds of an allocated buffer, which in this case can be triggered remotely via crafted DCERPC protocol messages and may be exploited to corrupt adjacent memory structures and ultimately achieve remote code execution.
Learn more: CWE-787 — Out-of-Bounds Write
Impact Analysis
CVE-2023-34048 carries a CVSS 3.1 score of 9.8 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Attack Vector (Network): the vulnerability is remotely exploitable without physical access — any attacker with network connectivity to the vCenter Server is a potential threat. Attack Complexity (Low): no special conditions, race conditions, or complex prerequisites are required to trigger the out-of-bounds write. Privileges Required (None) and User Interaction (None): the attack requires no authentication and no victim action, allowing fully unauthenticated, automated exploitation. Confidentiality (High), Integrity (High), and Availability (High): if exploited, an attacker can achieve remote code execution on the vCenter Server, gaining complete control over the virtualization management plane — including access to all managed virtual machines, stored credentials, and administrative functionality. With an EPSS score of 93.1% and confirmed in-the-wild exploitation, organizations must treat CVE-2023-34048 as an active emergency.
Exploit Maturity
Public exploit code is available for CVE-2023-34048 via vicarius.io, which provides an exploit analysis tagged as both Exploit and Third Party Advisory. CISA has confirmed active exploitation in the wild by adding CVE-2023-34048 to the Known Exploited Vulnerabilities catalog with a remediation deadline of February 12, 2024. With an EPSS score of 93.1% (99.8th percentile), exploitation activity is near-certain across the threat landscape. The combination of unauthenticated remote code execution, public exploit research, and confirmed active exploitation makes CVE-2023-34048 one of the most severe threats currently facing VMware vCenter Server environments.
Remediation
- Apply vendor mitigations immediately: Per the CISA KEV required action, apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Install the VMware security patch: Apply the patch for CVE-2023-34048 as detailed in VMware Security Advisory VMSA-2023-0023 (https://www.vmware.com/security/advisories/VMSA-2023-0023.html), which addresses the out-of-bounds write in the DCERPC protocol implementation.
- Restrict network access to vCenter Server: If immediate patching is not possible, implement firewall rules to restrict access to the vCenter Server management network (TCP/UDP ports used by DCERPC) to only trusted management hosts and VPN-connected administrators — eliminating the unauthenticated remote attack path.
- Monitor for exploitation indicators: Review vCenter Server logs for unexpected crashes, core dumps, or unusual DCERPC-related errors that could indicate exploitation attempts. Monitor for unauthorized administrative actions taken against managed virtual machines.
- Audit vCenter Server access controls and rotate credentials: Given the severity of the RCE impact and confirmed active exploitation, rotate all administrative credentials for vCenter Server and connected systems as a precautionary measure, and review access control lists for abnormal entries.
Technical Details
CVE-2023-34048 is an out-of-bounds write vulnerability (CWE-787) in VMware vCenter Server's implementation of the DCERPC (Distributed Computing Environment / Remote Procedure Call) protocol. Out-of-bounds write vulnerabilities occur when software writes data beyond the boundaries of an allocated memory buffer, which can corrupt adjacent memory structures including function pointers or security-relevant data — creating a pathway to arbitrary code execution. In this case, a remote attacker can send specially crafted DCERPC protocol messages to the vCenter Server's exposed RPC services, triggering the out-of-bounds write without any authentication. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the worst-case exploitability profile: fully network-accessible, no authentication required, no user interaction needed, and maximum impact on all three security dimensions. VMware has addressed the vulnerability through improved bounds checking in the patched vCenter Server releases as detailed in VMSA-2023-0023.
Frequently Asked Questions
Is CVE-2023-34048 being actively exploited?
Yes. CISA has confirmed active exploitation and added CVE-2023-34048 to the Known Exploited Vulnerabilities catalog with a remediation deadline of February 12, 2024. Public exploit research and analysis is available, and the EPSS score of 93.1% (99.8th percentile) confirms near-certain exploitation activity in the wild.
What products are affected by CVE-2023-34048?
CVE-2023-34048 affects VMware vCenter Server. Organizations should consult VMware Security Advisory VMSA-2023-0023 for the specific affected versions and the corresponding patched releases to determine their exposure.
How do I fix CVE-2023-34048?
Apply the patch provided by VMware as documented in VMSA-2023-0023. If immediate patching is not possible, restrict network access to the vCenter Server management interface to trusted hosts only, eliminating the remote unauthenticated attack surface. Per CISA guidance, apply vendor mitigations immediately or discontinue use.
How severe is CVE-2023-34048?
CVE-2023-34048 is rated CRITICAL with a CVSS 3.1 score of 9.8 — the highest possible severity. The EPSS score of 93.1% (99.8th percentile) confirms near-certain exploitation activity, and the unauthenticated remote code execution capability against VMware vCenter Server makes this a critical-priority vulnerability for all organizations running VMware virtualization infrastructure.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.