CVE-2021-21974

Katalog CVE

CVSS 8.8 · High EPSS 45,1%

Kerentanan Out-of-bounds Write pada vmware cloud foundation, vmware esxi. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overflow vulnerability. A malicious actor residing within the same network segment as ESXi who has access to port 427 may be able to trigger the heap-overflow issue in OpenSLP service resulting in remote code execution.

Rincian

Terbit di NVD

24 Februari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-787: Out-of-bounds Write

EPSS (30 hari)

45,1% peluang dieksploitasi; lebih tinggi dari 98,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 233 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://www.vmware.com/security/advisories/VMSA-2021-0002.html advisory vendor
• http://packetstormsecurity.com/files/162957/VMware-ESXi-OpenSLP-Heap-Overflow.html exploit · advisory pihak ketiga · vdb entry
• https://www.zerodayinitiative.com/advisories/ZDI-21-250/ advisory pihak ketiga · vdb entry