The ESXi Common Information Model (CIM) service must be disabled.

An XCCDF Rule

Description

The CIM system provides an interface that enables hardware-level management from remote applications via a set of standard application programming interfaces (APIs). These APIs are consumed by external applications such as HP SIM or Dell OpenManage for agentless, remote hardware monitoring of the ESXi host. To reduce attack surface area and following the minimum functionality principal, the CIM service must be disabled unless explicitly needed and approved.

ID: SV-256448r1051419_rule
Version: ESXI-70-000097
Severity: Medium
References: CCI-000366
Updated: about 2 months ago

Remediation Templates

From the vSphere Client, go to Hosts and Clusters.

Select the ESXi Host >> Configure >> System >> Services.

Select the "CIM Server" service. If the service is started, click "Stop". 
Click "Edit Startup Policy...". Select "Start and stop manually". Click "OK".

or

From a PowerCLI command prompt while connected to the ESXi host, run the following commands:

Get-VMHost | Get-VMHostService | Where {$_.Label -eq "CIM Server"} | Set-VMHostService -Policy Off
Get-VMHost | Get-VMHostService | Where {$_.Label -eq "CIM Server"} | Stop-VMHostService

The ESXi Common Information Model (CIM) service must be disabled.

Description

Remediation Templates

A Manual Procedure