OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue. A malicious actor residing in the management network who has access to port 427 on an ESXi machine may be able to trigger a use-after-free in the OpenSLP service resulting in remote code execution.
Metrics
No CVSS v4.0
Attack Vector Network
Attack Complexity Low
Privileges Required None
Scope Unchanged
Confidentiality Impact High
Integrity Impact High
Availability Impact High
User Interaction None
No CVSS v3.0
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact Complete
Integrity Impact Complete
Availability Impact Complete
This CVE is in the KEV database since Nov. 3, 2021.
Exploitation active
Automatable yes
Technical Impact total
Affected Vendors & Products
Vendors | Products |
---|---|
Vmware |
|
Configuration 1 [-]
|
No data.
References
History
Wed, 29 Jan 2025 18:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
kev
|

Status: PUBLISHED
Assigner: vmware
Published:
Updated: 2025-01-29T17:59:10.398Z
Reserved: 2019-12-30T00:00:00.000Z
Link: CVE-2020-3992

Updated: 2024-08-04T07:52:20.539Z

Status : Modified
Published: 2020-10-20T17:15:12.810
Modified: 2025-01-29T18:15:35.950
Link: CVE-2020-3992

No data.