CVE-2021-21974Esxi Out-of-Bounds Write
OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overflow vulnerability.
Published Feb 8, 2023 · Updated Jun 2, 2026 · Also known as TR-23-0067
Key Facts
Patch immediately- CVE-2021-21974 is a high-severity vulnerability (CVSS 8.8 v3.1) affecting Cloud Foundation (Vmware), Esxi (Vmware).
- It is exploited in the wild, listed in Industry KEV feed since Feb 3, 2023. Public exploit code is available.
- EPSS estimates a 45% probability of exploitation in the next 30 days.
- Fixed versions are available, including Cloud Foundation 3.10.1.2.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Scores
CVSS v3.1
8.8
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
45%
Higher than 98.7% of all scored CVEs
Exploit maturity
Proof of concept
ATLAS score
45/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Feb 3, 2023
Federal due date
None
No federal due date
Attributed actors
Exploit & Defence Guidance
Exploit maturity
Proof of concept
Public exploit code
1
Proof-of-concept links
In-the-wild evidence
10
Reports of active use
Advisories And Exploit References
- advisoryhttps://borncity.com/win/2021/02/24/vmware-fixt-kritische-rce-schwachstelle-im-vsphere-html5-client/
- advisoryhttps://launchpad.net/ubuntu/+source/openssl1.0/1.0.2n-1ubuntu5.11
- advisoryhttps://lifars.com/2021/03/vmware-warns-of-critical-remote-code-execution-vulnerability-in-vsphere-html5-client/
- advisoryhttps://ubuntu.com/security/notices/USN-5844-1
- advisoryhttps://ubuntu.com/security/notices/USN-5845-1
- advisoryhttps://us-cert.cisa.gov/ncas/current-activity/2021/02/24/vmware-releases-multiple-security-updates
Description
OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overflow vulnerability. A malicious actor residing within the same network segment as ESXi who has access to port 427 may be able to trigger the heap-overflow issue in OpenSLP service resulting in remote code execution.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| Industry KEV feed | Feb 3, 2023 | n/a | Not reported |
Affected Products
234 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Cloud FoundationVmware | >= 4.x before 4.2 and 3.x | 3.10.1.2 |
| EsxiVmware | 6.5, 6.5-2, 6.5-650-201701001, 6.5-650-201703001, 6.5-650-201703002, 6.5-650-201704001, 6.5-650-201707101, 6.5-650-201707102 | n/a |
Patched Releases
Cloud Foundation
3.10.1.2
Timeline
Added to Industry KEV feed
Feb 3, 2023
Publicly disclosed
Feb 8, 2023
Last updated
Jun 2, 2026
Weakness Type
- CWE-787 Out-of-bounds Write
References
- advisoryborncity.com · vmware-fixt-kritische-rce-schwachstelle-im-vsph…
- advisorylaunchpad.net · 1.0.2n-1ubuntu5.11
- advisorylifars.com · vmware-warns-of-critical-remote-code-execution-…
- advisoryubuntu.com · USN-5844-1
- advisoryubuntu.com · USN-5845-1
FAQ
Common Questions.
OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overflow vulnerability.
Affected: Cloud Foundation (Vmware) versions >= 4.x before 4.2 and 3.x; Esxi (Vmware) versions 6.5, 6.5-2, 6.5-650-201701001, 6.5-650-201703001, 6.5-650-201703002, 6.5-650-201704001, 6.5-650-201707101, 6.5-650-201707102. The full list is in the CVE brief.
It is exploited in the wild, listed in Industry KEV feed since Feb 3, 2023.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Cloud Foundation 3.10.1.2.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2021-21974 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo