A severe vCenter Server vulnerability that may be used to launch remote code execution attacks on systems that are susceptible was fixed by VMware with security upgrades.

Administrators can better manage and keep an eye on virtualized infrastructure with the aid of vCenter Server, the primary management center for VMware’s vSphere suite.

The vulnerability (CVE-2023-34048) is caused by an out-of-bounds write issue in the DCE/RPC protocol implementation of vCenter and was discovered by Grigory Dorodnov of Trend Micro’s Zero Day Initiative.

Low-complexity attacks that don’t require user involvement can be used by unauthenticated attackers to remotely exploit it. According to the business, there is no proof that attacks are presently utilizing the CVE-2023-34048 RCE vulnerability.

Now, security updates that fix this problem may be downloaded using the usual vCenter Server update methods. VMware has also released fixes for a number of end-of-life products that are no longer receiving active support due to the serious severity of this fault.

“While VMware does not mention end-of-life products in VMware Security Advisories, due to the critical severity of this vulnerability and lack of workaround VMware has made a patch generally available for vCenter Server 6.7U3, 6.5U3, and VCF 3.x,” the business stated.

VMware has released several updates for vCenter Server 8.0U1 for the same reasons. For installations using VCF 5.x and 4.x, async vCenter Server fixes are now available.”