CVE-2023-34039
Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of...
Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation. A malicious actor with network access to Aria Operations for Networks could bypass SSH authentication to gain access to the Aria Operations for Networks CLI.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation. A malicious actor with network access to Aria Operations for Networks could bypass SSH authentication to gain access to the Aria Operations for Networks CLI.
- Record
CVE-2023-34039- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
EUVDEUVD-2023-38160
Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation. A malicious actor with network access to Aria Operations for Networks could bypass SSH authentication to gain access to the Aria Operations for Networks CLI.
- Record
EUVD-2023-38160- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hvfm-xp6c-5fc9
Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of...
Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation. A malicious actor with network access to Aria Operations for Networks could bypass SSH authentication to gain access to the Aria Operations for Networks CLI.
- Record
GHSA-hvfm-xp6c-5fc9- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-327
- Updated
- 2026-11-02
NVD
Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation. A malicious actor with network access to Aria Operations for Networks could bypass SSH authentication to gain access to the Aria Operations for Networks CLI.
- Record
CVE-2023-34039- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-327
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | VMWare Aria Operations for Networks (vRealize Network Insight) SSH Private Key Exposure | 2023-08-29 |
| Nuclei | VMWare Aria Operations - Remote Code Execution | |
| PoC in GitHub | CharonDefalt/CVE-2023-34039 | 2023-09-02 |
| PoC in GitHub | Cyb3rEnthusiast/CVE-2023-34039 | 2023-09-03 |
| PoC in GitHub | adminxb/CVE-2023-34039 | 2023-11-10 |
| PoC in GitHub | sinsinology/CVE-2023-34039 | 2023-09-01 |
| PoC in GitHub | syedhafiz1234/CVE-2023-34039 | 2023-09-04 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, Metasploit, Nuclei, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-34039 is a critical vulnerability (CVSS 9.8) in Vmware Aria Operations For Networks, published August 29, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 67.2%, the 99th percentile. No source names a fixed version.
References
vmware.com/security/advisories/VMSA-2023-0018.html
packetstormsecurity.com/files/174452/VMWare-Aria-Operations-For-Networks-Remote-Code-Execution.html
nvd.nist.gov/vuln/detail/CVE-2023-34039
github.com/advisories/GHSA-hvfm-xp6c-5fc9