{"id":"CVE-2021-21974","published":"2021-02-24T16:57:33Z","modified":"2026-06-02T20:00:52Z","title":"OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before…","vendor":null,"product":null,"tier":"core","eol":null,"affectedVersions":[{"vendor":"n/a","product":"VMware ESXi","versions":["7.0 before ESXi70U1c-17325551","6.7 before ESXi670-202102401-SG","6.5 before ESXi650-202102101-SG"]},{"vendor":"n/a","product":"VMware Cloud Foundation","versions":["4.x before 4.2 and 3.x"]}],"description":{"text":"OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overflow vulnerability. A malicious actor residing within the same network segment as ESXi who has access to port 427 may be able to trigger the heap-overflow issue in OpenSLP service resulting in remote code execution.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is a heap-overflow vulnerability in OpenSLP as used in ESXi, affecting the OpenSLP service in the ESXi hypervisor product line. An attacker on the same network segment as ESXi with access to port 427 can trigger the overflow in the OpenSLP service, which may lead to remote code execution without authentication or user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:15:31Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.45063,"percentile":0.98783,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2023-02-03","exploitedFirstSeen":"2023-02-03","ransomware":true,"evidence":[{"url":"https://www.cert.ssi.gouv.fr/alerte/CERTFR-2023-ALE-015/","date":"2023-02-03"},{"url":"https://www.wiz.io/blog/ransomware-attacks-targeting-vmware-esxi-servers-everything-you-need-to-know","date":"2023-02-07"},{"url":"https://4502402.fs1.hubspotusercontent-na1.net/hubfs/4502402/Ransomware%20-%20Index%20Update%20Q1%202023.pdf","date":"2023-05-15"},{"url":"https://www.crowdstrike.com/blog/hypervisor-jackpotting-lack-of-antivirus-support-opens-the-door-to-adversaries/","date":"2023-05-15"},{"url":"https://blog.sekoia.io/sekoia-io-mid-2023-ransomware-threat-landscape","date":"2023-09-14"},{"url":"https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/tortoise-and-malwahare.html","date":"2023-12-05"},{"url":"https://unit42.paloaltonetworks.com/unit-42-ransomware-leak-site-data-analysis/","date":"2024-02-05"},{"url":"https://go.recordedfuture.com/hubfs/reports/cta-2024-0208.pdf","date":"2024-02-08"},{"url":"https://www.ibm.com/downloads/cas/L0GKXDWJ","date":"2024-02-22"},{"url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2024-CTI-002.pdf","date":"2024-02-27"}],"evidenceTotal":15,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"}],"references":[{"url":"https://www.vmware.com/security/advisories/VMSA-2021-0002.html","tags":["x_refsource_CONFIRM"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-21-250/","tags":["x_refsource_MISC"]},{"url":"http://packetstormsecurity.com/files/162957/VMware-ESXi-OpenSLP-Heap-Overflow.html","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[{"id":"SRC-18fd26fa020f9a3dac70","title":"The Tortoise and The Malwahare","publisher":"pwc.com","url":"https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/tortoise-and-malwahare.html","date":null,"mentions":[{"quote":"We assess that Teal Kurma has likely continued leveraging major CVEs in its current campaigns, particularly ones with publicly available proof-of-concept code such as CVE-2021-44228, CVE-2021-21974, and CVE-2022-0847.","start":6231,"end":6448},{"quote":"It is highly plausible that the threat actor is also using other code observed on this GitHub, particularly some of the proof-of-concept exploit code for major vulnerabilities, such as CVE-2021-21974 or a ESXi OpenSLP heap-overflow vulnerability.","start":12386,"end":12632}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-9145","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-9145","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":6,"skipped":1,"earliest":"2021-05-25","earliestUrl":"https://github.com/Shadow0ps/CVE-2021-21974","repos":[{"name":"Shadow0ps/CVE-2021-21974","url":"https://github.com/Shadow0ps/CVE-2021-21974","stars":188,"created":"2021-05-25"},{"name":"Aiyakami/CVE-2021-21974","url":"https://github.com/Aiyakami/CVE-2021-21974","stars":6,"created":"2026-07-08"},{"name":"n2x4/Feb2023-CVE-2021-21974-OSINT","url":"https://github.com/n2x4/Feb2023-CVE-2021-21974-OSINT","stars":2,"created":"2023-02-04"},{"name":"CYBERTHREATANALYSIS/ESXi-Ransomware-Scanner-mi","url":"https://github.com/CYBERTHREATANALYSIS/ESXi-Ransomware-Scanner-mi","stars":2,"created":"2023-02-08"},{"name":"hateme021202/cve-2021-21974","url":"https://github.com/hateme021202/cve-2021-21974","stars":0,"created":"2023-10-19"}]},"first":{"date":"2021-05-25","source":"PoC-in-GitHub","url":"https://github.com/Shadow0ps/CVE-2021-21974"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/162957/VMware-ESXi-OpenSLP-Heap-Overflow.html"],"flow":[],"timeline":[{"date":"2021-02-24","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2021-21974","provenance":"source"},{"date":"2021-05-25","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/Shadow0ps/CVE-2021-21974","provenance":"source"},{"date":"2023-02-03","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cert.ssi.gouv.fr/alerte/CERTFR-2023-ALE-015/","provenance":"source"}],"speed":{"daysToPublicExploit":90,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":79.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1367 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.76,"detail":"percentile 0.9878"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD exploit link; 6 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}