STIGQter: STIG Summary: VMware vSphere 7.0 ESXi Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 02 Apr 2025:

The ESXi host must not provide root/administrator-level access to Common Information Model (CIM)-based hardware monitoring tools or other third-party applications.

DISA Rule

SV-256427r959010_rule

Vulnerability Number

V-256427

Group Title

SRG-OS-000480-VMM-002000

Rule Version

ESXI-70-000070

Severity

CAT II

CCI(s)

CCI-000366 - Implement the security configuration settings.

Weight

Fix Recommendation

If write access is required, create a new role for the CIM service account:

From the Host Client, go to Manage >> Security & Users.

Select "Roles" and click "Add role".

Provide a name for the new role and select Host >> Cim >> Ciminteraction and click "Add".

Add a CIM service account:

From the Host Client, go to Manage >> Security & Users.

Select "Users" and click "Add user".

Provide a name, description, and password for the new user and click "Add".

Assign the CIM service account permissions to the host with the new role:

From the Host Client, select the ESXi host, right-click, and go to "Permissions".

Click "Add User", select the CIM service account from the drop-down list, and select either "Read-only" or the role just created. Click "Add User".

Check Contents

If CIM monitoring is not implemented, this is not applicable.

From the Host Client, select the ESXi host, right-click, and go to "Permissions".

Verify the CIM service account is assigned the "Read-only" role or a custom role as described in the discussion.

If there is no dedicated CIM service account, this is a finding.

If the CIM service account has more permissions than necessary as noted in the discussion, this is a finding.

Vulnerability Number

V-256427

Documentable

False

Rule Version

ESXI-70-000070

Severity Override Guidance

Check Content Reference

Target Key

5518