The ESXi host must be configured to disable nonessential capabilities by disabling the Managed Object Browser (MOB).
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-258736 | ESXI-80-000047 | SV-258736r933269_rule | CCI-000381 | medium |
| Description | ||||
| The MOB provides a way to explore the object model used by the VMkernel to manage the host and enables configurations to be changed. This interface is meant to be used primarily for debugging the vSphere Software Development Kit (SDK), but because there are no access controls it could also be used as a method to obtain information about a host being targeted for unauthorized access. | ||||
| STIG | Date | |||
| VMware vSphere 8.0 ESXi Security Technical Implementation Guide | 2023-10-11 | |||
Related Frameworks
3 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
CM-7
1.00
- DISA · V1R1 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1711 mapping
3.4.6
1.00
- DISA · V1R1 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000381
1.00
- DISA · V1R1 · disa_xccdf · related
Details
Check Text (C-258736r933269_chk)
From the vSphere Client, go to Hosts and Clusters.
Select the ESXi Host >> Configure >> System >> Advanced System Settings.
Select the "Config.HostAgent.plugins.solo.enableMob" value and verify it is set to "false".
or
From a PowerCLI command prompt while connected to the ESXi host, run the following command:
Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.plugins.solo.enableMob
If the "Config.HostAgent.plugins.solo.enableMob" setting is not set to "false", this is a finding.
Fix Text (F-62385r933268_fix)
From the vSphere Client, go to Hosts and Clusters.
Select the ESXi Host >> Configure >> System >> Advanced System Settings.
Click "Edit". Select the "Config.HostAgent.plugins.solo.enableMob" value and configure it to "false".
or
From a PowerCLI command prompt while connected to the ESXi host, run the following command:
Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.plugins.solo.enableMob | Set-AdvancedSetting -Value false