{"vulnerability": "CVE-2024-22252", "sightings": [{"uuid": "528ae3fe-e92f-4f54-82bd-adbad24fbafd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-22252", "type": "seen", "source": "https://bsky.app/profile/cyberalerts.bsky.social/post/3llf5v3pwof2m", "content": "", "creation_timestamp": "2025-03-27T20:40:16.873802Z"}, {"uuid": "008d075b-7adb-4460-8add-9d2b28ec52bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2024-22252", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=1240", "content": "", "creation_timestamp": "2024-03-06T04:00:00.000000Z"}, {"uuid": "197de18e-2012-4b21-b2ac-f98336f308d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-22252", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/6761", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2024\n\u63cf\u8ff0\uff1aCVE-2024-22252 VMware ESXi, Workstation RCE on HOST\nURL\uff1ahttps://github.com/crackmapEZec/CVE-2024-22252-POC\n\n\u6807\u7b7e\uff1a#CVE-2024", "creation_timestamp": "2024-03-09T19:59:19.000000Z"}, {"uuid": "8b7f11d5-01c0-48a5-a629-78d9758f97e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-22252", "type": "seen", "source": "Telegram/jwW2woILuMB3B0nr7ysTJhX7s0KYCMEe-3rqFoaiqoXNpQ", "content": "", "creation_timestamp": "2024-03-06T13:07:19.000000Z"}, {"uuid": "2f50d044-47b9-408f-9967-3c41108fa25a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-22252", "type": "seen", "source": "https://t.me/KomunitiSiber/1592", "content": "VMware Issues Security Patches for ESXi, Workstation, and Fusion Flaws\nhttps://thehackernews.com/2024/03/vmware-issues-security-patches-for-esxi.html\n\nVMware has released patches to address four security flaws impacting ESXi, Workstation, and Fusion, including two critical flaws that could lead to code execution.\nTracked as\u00a0CVE-2024-22252 and CVE-2024-22253, the vulnerabilities have been described as use-after-free bugs in the XHCI USB controller. They carry a CVSS score of 9.3 for Workstation and Fusion, and 8.4 for ESXi systems.\n\"A", "creation_timestamp": "2024-03-06T09:22:51.000000Z"}, {"uuid": "d4ae7c9b-ce34-47aa-8c12-21cf792f818e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-22252", "type": "seen", "source": "https://t.me/ViralCyber/10409", "content": "\u26a0\ufe0f\u062a\u0639\u062f\u0627\u062f 427 \u0633\u0631\u0648\u0631 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631 VMware \u062f\u0631 \u0627\u06cc\u0631\u0627\u0646!\n\ud83d\udfe1\u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u0627 \u0634\u0646\u0627\u0633\u0647 CVE-2024-22252 \u06cc\u06a9 \u0646\u0642\u0635 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0627\u0632 \u0646\u0648\u0639 \u00abuse-after-free\u00bb \u062f\u0631 \u06a9\u0646\u062a\u0631\u0644\u0631 XHCI USB \u0645\u062d\u0635\u0648\u0644\u0627\u062a VMware \u0627\u0633\u062a. \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062f\u0631 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc ESXi\u060c Workstation \u0648 Fusion \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0634\u062f\u0647 \u0648 \u0628\u0647 \u0645\u0647\u0627\u062c\u0645 \u0628\u0627 \u062f\u0633\u062a\u0631\u0633\u06cc \u0645\u062f\u06cc\u0631\u06cc\u062a\u06cc \u0645\u062d\u0644\u06cc \u062f\u0631 \u0645\u0627\u0634\u06cc\u0646 \u0645\u062c\u0627\u0632\u06cc \u0627\u0645\u06a9\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u062f \u0645\u062e\u0631\u0628 \u0631\u0627 \u0628\u0647\u200c\u0639\u0646\u0648\u0627\u0646 \u0641\u0631\u0622\u06cc\u0646\u062f VMX \u062f\u0631 \u0645\u06cc\u0632\u0628\u0627\u0646 \u0627\u062c\u0631\u0627 \u06a9\u0646\u062f. \u062f\u0631 \u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627\u06cc ESXi\u060c \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062f\u0631 \u0645\u062d\u06cc\u0637 VMX Sandbox \u0645\u062d\u062f\u0648\u062f \u0645\u06cc\u200c\u0634\u0648\u062f\u060c \u062f\u0631 \u062d\u0627\u0644\u06cc \u06a9\u0647 \u062f\u0631 Workstation \u0648 Fusion \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0645\u0646\u062c\u0631 \u0628\u0647 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u062f\u0631 \u0633\u06cc\u0633\u062a\u0645 \u0645\u06cc\u0632\u0628\u0627\u0646 \u0634\u0648\u062f. \n\ud83d\udfe1\u0627\u0645\u062a\u06cc\u0627\u0632 CVSS \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062f\u0631 Workstation \u0648 Fusion \u0628\u0631\u0627\u0628\u0631 \u0628\u0627 9.3 (\u0628\u062d\u0631\u0627\u0646\u06cc) \u0648 \u062f\u0631 ESXi \u0628\u0631\u0627\u0628\u0631 \u0628\u0627 8.4 \u0627\u0631\u0632\u06cc\u0627\u0628\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a. \n\ud83d\udfe1\u0622\u062e\u0631\u06cc\u0646 \u0627\u0633\u06a9\u0646 \u0646\u0634\u0627\u0646 \u0645\u06cc \u062f\u0647\u062f \u06a9\u0647 \u062a\u0639\u062f\u0627\u062f 427 \u062a\u0627 \u0633\u0631\u0648\u0631 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631 VMware \u062f\u0631 \u0627\u06cc\u0631\u0627\u0646 \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f \u06a9\u0647 \u0647\u0646\u0648\u0632 Patch \u0646\u0634\u062f\u0647 \u0627\u0646\u062f.\n\n\u2709\ufe0f @PingChannel\n\u062e\u0628\u0631\u060c \u062a\u062d\u0644\u06cc\u0644\u060c \u0627\u0646\u062a\u0642\u0627\u062f - \u0641\u0646\u0627\u0648\u0631\u06cc \u0627\u0637\u0644\u0627\u0639\u0627\u062a\n\ud83d\udd2b\ud83d\udd2b\ud83d\udd2b\ud83d\udd2b\u00a0 \ud83d\udd2b\ud83d\udd2b\ud83d\udd2b\ud83d\udd2b\ud83d\udd2b\ud83d\udd2b\ud83d\udd2b", "creation_timestamp": "2025-01-23T21:10:05.000000Z"}, {"uuid": "e07741d9-4438-4eec-8a07-cdb7691595bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-22252", "type": "seen", "source": "https://t.me/arpsyndicate/4115", "content": "#ExploitObserverAlert\n\nCVE-2024-22252\n\nDESCRIPTION: Exploit Observer has 3 entries in 1 file formats related to CVE-2024-22252. VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller.\u00a0A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed.", "creation_timestamp": "2024-03-06T15:41:00.000000Z"}, {"uuid": "ba1f4f37-4b23-4ace-827e-fd841f0bd3f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-22252", "type": "seen", "source": "Telegram/hk8eFERwlhelxRhSNb_S4Dk3xQ7fpjxSuZyVFO5BPa2UKQ", "content": "", "creation_timestamp": "2024-03-06T10:07:34.000000Z"}, {"uuid": "ce002afc-afe4-43ed-a0c1-aabed03a3370", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-22252", "type": "seen", "source": "https://t.me/true_secator/5493", "content": "VMware \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0447\u0435\u0442\u044b\u0440\u0435\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0445 ESXi, Workstation \u0438 Fusion, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0434\u0432\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a RCE.\n\nCVE-2024-22252 \u0438 CVE-2024-22253 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u0441\u043e\u0431\u043e\u0439 \u043e\u0448\u0438\u0431\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0441\u043b\u0435 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0432 USB-\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0435 XHCI \u0441  \u043e\u0446\u0435\u043d\u043a\u043e\u0439 CVSS 9,3 (\u0434\u043b\u044f Workstation \u0438 Fusion) \u0438 8,4 (\u0434\u043b\u044f \u0441\u0438\u0441\u0442\u0435\u043c ESXi).\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u043d\u0430 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u0435 \u043c\u043e\u0436\u0435\u0442 \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 VMX \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u044b, \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0433\u043e \u043d\u0430 \u0445\u043e\u0441\u0442\u0435.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0438 \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Ant Group Light-Year \u0438 QiAnXin.\n\n\u041f\u043e\u043c\u0438\u043c\u043e \u043d\u0430\u0437\u0432\u0430\u043d\u043d\u044b\u0445 VMware \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441 \u0421VSS: 7,9: CVE-2024-22254 \u0438 CVE-2024-22255.\n\n\u041f\u0435\u0440\u0432\u0430\u044f\u00a0\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u043f\u0438\u0441\u0438 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u0430\u043c\u0438 \u0433\u0440\u0430\u043d\u0438\u0446 \u0432 ESXi \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0441 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 VMX \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u0432\u044b\u0445\u043e\u0434 \u0438\u0437 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b.\n\n\u0414\u0440\u0443\u0433\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0432 USB-\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0435 UHCI \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c \u0441 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u043a \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u0435 \u0434\u043b\u044f \u0443\u0442\u0435\u0447\u043a\u0438 \u043f\u0430\u043c\u044f\u0442\u0438 \u0438\u0437 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 vmx.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0442\u0435, \u0441\u0440\u043e\u043a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u0442\u0435\u043a (EoL): ESXi 6.5 -\u00a06.5U3\u0432; ESXi 6.7 -\u00a06.7U3u; ESXi 7.0 -\u00a0ESXi70U3p-23307199; ESXi 8.0 -\u00a0ESXi80U2sb-23305545\u00a0 \u0438\u00a0ESXi80U1d-23299997;  VMware Cloud Foundation (VCF) 3.x; Workstation 17.x - 17.5.1 \u0438 Fusion 13.x (macOS) - 13.5.1.\n\n\u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0433\u043e \u0440\u0435\u0448\u0435\u043d\u0438\u044f, \u043f\u043e\u043a\u0430 \u043d\u0435 \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u0442\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435, \u043a\u043b\u0438\u0435\u043d\u0442\u0430\u043c \u0431\u044b\u043b\u043e \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043e \u0443\u0434\u0430\u043b\u0438\u0442\u044c \u0432\u0441\u0435 USB-\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u044b \u0438\u0437 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u044b.", "creation_timestamp": "2024-03-06T14:09:12.000000Z"}, {"uuid": "ac8165f7-8dbb-4c6e-a4cd-6f8bcf2c7079", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-22252", "type": "seen", "source": "https://t.me/ctinow/200613", "content": "https://ift.tt/eTjEWZy\nCVE-2024-22252", "creation_timestamp": "2024-03-05T19:26:30.000000Z"}, {"uuid": "e659241c-8f87-4112-a0b7-42753dfd584b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-22252", "type": "seen", "source": "https://t.me/ctinow/200607", "content": "https://ift.tt/eTjEWZy\nCVE-2024-22252", "creation_timestamp": "2024-03-05T19:26:23.000000Z"}]}