NetSight
IP …
high8.8

CVE-2021-21974

OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overflow vulnerability.

Impact

OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overflow vulnerability. A malicious actor residing within the same network segment as ESXi who has access to port 427 may be able to trigger the heap-overflow issue in OpenSLP service resulting in remote code execution.

Affected products

VendorProductAffected versions
VmwareCloud Foundation
from 3.0 before 3.10.1.2
from 4.0 before 4.2
VmwareEsxi
Versions 6.5, 6.7, 7.0.0

Weakness classification

CWE-787

References