CVE-2013-1659

Severity: high (CVSS 7.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-02-22 · updated 2026-06-16

Description

VMware vCenter Server 4.0 before Update 4b, 5.0 before Update 2, and 5.1 before 5.1.0b; VMware ESXi 3.5 through 5.1; and VMware ESX 3.5 through 4.1 do not properly implement the Network File Copy (NFC) protocol, which allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption) by modifying the client-server data stream.

Affected products

VMware ESXi: 3.5-1, 4.0-1, 4.0-2, 4.0-3, 4.0-4, 4.1-1 (+3); 3.5, 4.0, 4.1, 5.0, 5.1 (and their updates)
VMware vCenter Server: 4.0-update_1, 4.0-update_2, 4.0-update_3, 4.0-update_4, 4.0-update_4a, 5.0-update_1; 4.0, 5.0 (and their updates)
VMware Vcenter Server Appliance: 5.1, 5.1.0a (and their updates)

References

Get alerted when CVE-2013-1659 or the next vulnerability affects your stack