ESXi CVE-2021-21974
HIGHCVSS VectorNVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overflow vulnerability. A malicious actor residing within the same network segment as ESXi who has access to port 427 may be able to trigger the heap-overflow issue in OpenSLP service resulting in remote code execution.
AnalysisAI
VMware ESXi versions 7.0 before U1c, 6.7 before specific patches, and 6.5 before specific patches contain a heap overflow in the OpenSLP service accessible on port 427. An attacker on the same network segment can trigger remote code execution on the ESXi hypervisor, compromising all virtual machines hosted on the server.
Technical ContextAI
The OpenSLP (Service Location Protocol) service on ESXi listens on UDP/TCP port 427 and is accessible from the management network. A heap overflow in the SLP message parsing allows an attacker on the same network segment to execute arbitrary code in the context of the SLP daemon, which runs with high privileges on the ESXi host.
Affected ProductsAI
VMware ESXi 7.0 before ESXi70U1c-17325551 VMware ESXi 6.7 before ESXi670-202102401-SG VMware ESXi 6.5 before ESXi650-202102101-SG
RemediationAI
Apply VMware security patches immediately. Disable the OpenSLP service if not required (esxcli network firewall ruleset set -e false -r CIMSLP). Restrict port 427 access via ESXi firewall rules. Segment ESXi management networks from general user networks. Implement offline VM backups.
Share
External POC / Exploit Code
Leaving vuln.today