Description
OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue. A malicious actor residing in the management network who has access to port 427 on an ESXi machine may be able to trigger a use-after-free in the OpenSLP service resulting in remote code execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | VMware ESXi | VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
dgh05t/VMware_ESXI_OpenSLP_PoCs ★ 68 · Feb 4, 2021
CVE-2020-3992 & CVE-2019-5544
-
HynekPetrak/CVE-2019-5544_CVE-2020-3992 ★ 50 · Dec 1, 2020
Python / scapy module implementing SRVLOC/SLP protocol and scans for enabled OpenSLP services.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.