CVE-2017-4919 VMware vCenter Server 5.5, 6.0, 6.5 allows vSphere users with certain, limited vSphere privileges to use the VIX API to access Guest Operating Systems without the need to authenticate.

CriticalCVSS 9.0 EPSS 2.0%

Published: 2017-07-29 01:00
Updated: 2026-06-17 04:19
Exploit status: No public exploit known

Description

VMware vCenter Server 5.5, 6.0, 6.5 allows vSphere users with certain, limited vSphere privileges to use the VIX API to access Guest Operating Systems without the need to authenticate.

Affected products

Product	Affected versions	Fixed in
VMware vcenter server	= 5.5	No fix listed
VMware vcenter server	= 6.0	No fix listed
VMware vcenter server	= 6.5	No fix listed
VMware vCenter Server	= VMware vCenter Server 5.5.x, 6.0.x, 6.5.x	No fix listed

References

100102 third-party-advisory vdb-entry
1039004 third-party-advisory vdb-entry
www.vmware.com mitigation vendor-advisory

CVSS v3.0

9.0 Critical

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector: Network
Attack Complexity: High
Privileges Required: None
User Interaction: None
Scope: Changed
Confidentiality: High
Integrity: High
Availability: High

All scores (2)

v3.0 9.0 · nvd@nist.gov
v2.0 6.8 · nvd@nist.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 2.04% (percentile 81.4)
CWE: CWE-306

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.