Description

CVE-2024-22250 is a Session Hijack vulnerability in the Deprecated VMware Enhanced Authentication Plug-in. It allows a malicious actor with unprivileged local access to a Windows operating system to hijack a privileged EAP session when initiated by a privileged domain user on the same system. The SVRS for this CVE is 0, indicating a low level of urgency and severity.

Key Insights

• This vulnerability can be exploited by an attacker with local access to a Windows system.
• The attacker can hijack a privileged EAP session, allowing them to gain access to sensitive information or perform malicious actions.
• The vulnerability is not actively exploited in the wild, but it is important to patch affected systems as soon as possible.

Mitigation Strategies

• Update to the latest version of VMware Enhanced Authentication Plug-in.
• Disable the Enhanced Authentication Plug-in if it is not required.
• Implement network segmentation to limit the attacker's ability to access privileged EAP sessions.
• Monitor for suspicious activity and investigate any unauthorized access attempts.

Additional Information

• There are no known threat actors or APT groups actively exploiting this vulnerability.
• CISA has not issued a warning for this vulnerability.
• If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.