CVE-2013-1405

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-02-15 · updated 2026-06-16
Weakness: CWE-287

Description

VMware vCenter Server 4.0 before Update 4b and 4.1 before Update 3a, VMware VirtualCenter 2.5, VMware vSphere Client 4.0 before Update 4b and 4.1 before Update 3a, VMware VI-Client 2.5, VMware ESXi 3.5 through 4.1, and VMware ESX 3.5 through 4.1 do not properly implement the management authentication protocol, which allow remote servers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

Affected products

VMware ESX: 3.5-update1, 3.5-update2, 3.5-update3; 3.5, 4.0, 4.1 (and their updates)
VMware ESXi: 3.5-1, 4.0-1, 4.0-2, 4.0-3, 4.0-4; 3.5, 4.0, 4.1 (and their updates)
VMware vCenter Server: 4.0-update_4, 4.1-update_3
VMware Vi-Client: 2.5 (and their updates)
VMware Virtualcenter: 2.5 (and their updates)
VMware Vsphere Client: 4.0-update_4, 4.1-update_3

References

Get alerted when CVE-2013-1405 or the next vulnerability affects your stack