{"id":"CVE-2021-21974","published":"2021-02-24T16:57:33Z","modified":"2026-06-02T20:00:52Z","title":"OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before…","vendor":null,"product":null,"tier":"core","eol":null,"affectedVersions":[{"vendor":"n/a","product":"VMware ESXi","versions":["7.0 before ESXi70U1c-17325551","6.7 before ESXi670-202102401-SG","6.5 before ESXi650-202102101-SG"]},{"vendor":"n/a","product":"VMware Cloud Foundation","versions":["4.x before 4.2 and 3.x"]}],"description":{"text":"OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overflow vulnerability. A malicious actor residing within the same network segment as ESXi who has access to port 427 may be able to trigger the heap-overflow issue in OpenSLP service resulting in remote code execution.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is a heap-overflow vulnerability in OpenSLP as used in ESXi, affecting the OpenSLP service in the ESXi hypervisor product line. An attacker on the same network segment as ESXi with access to port 427 can trigger the overflow in the OpenSLP service, which may lead to remote code execution without authentication or user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:15:31Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.45063,"percentile":0.98779,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2023-02-03","exploitedFirstSeen":"2023-02-03","ransomware":true,"evidence":[{"url":"https://www.cert.ssi.gouv.fr/alerte/CERTFR-2023-ALE-015/","date":"2023-02-03"},{"url":"https://www.wiz.io/blog/ransomware-attacks-targeting-vmware-esxi-servers-everything-you-need-to-know","date":"2023-02-07"},{"url":"https://4502402.fs1.hubspotusercontent-na1.net/hubfs/4502402/Ransomware%20-%20Index%20Update%20Q1%202023.pdf","date":"2023-05-15"},{"url":"https://www.crowdstrike.com/blog/hypervisor-jackpotting-lack-of-antivirus-support-opens-the-door-to-adversaries/","date":"2023-05-15"},{"url":"https://blog.sekoia.io/sekoia-io-mid-2023-ransomware-threat-landscape","date":"2023-09-14"},{"url":"https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/tortoise-and-malwahare.html","date":"2023-12-05"},{"url":"https://unit42.paloaltonetworks.com/unit-42-ransomware-leak-site-data-analysis/","date":"2024-02-05"},{"url":"https://go.recordedfuture.com/hubfs/reports/cta-2024-0208.pdf","date":"2024-02-08"},{"url":"https://www.ibm.com/downloads/cas/L0GKXDWJ","date":"2024-02-22"},{"url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2024-CTI-002.pdf","date":"2024-02-27"}],"evidenceTotal":15,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"ClingSTUN Turns Vulnerable Edge Devices Into Attacker Infrastructure","url":"https://otx.alienvault.com/pulse/6ad1a6eb3af1f746d2dbb6fe","created":"2026-10-16"},{"name":"ClingSTUN Turns Vulnerable Edge Devices Into Attacker Infrastructure","url":"https://otx.alienvault.com/pulse/6acf7922d9bc17d95d27ec5c","created":"2026-10-14"},{"name":"Lunex Uses BYOVD to Disable Security Monitoring and Deploy Persistent Stealer","url":"https://otx.alienvault.com/pulse/6ac5dad9336ba666461a2df6","created":"2026-10-07"},{"name":"Lunex Uses BYOVD to Disable Security Monitoring and Deploy Persistent Stealer","url":"https://otx.alienvault.com/pulse/6ac4b1c8431cd87d87aa1784","created":"2026-10-06"},{"name":"NightLedger Backdoor Deployed in Espionage Campaign Targeting the Middle East and Africa","url":"https://otx.alienvault.com/pulse/6a72c0ecfc9810cf36944f17","created":"2026-08-05"},{"name":"NightLedger Backdoor Deployed in Espionage Campaign Targeting the Middle East and Africa","url":"https://otx.alienvault.com/pulse/6a72c0e8b782034f5d99d595","created":"2026-08-05"},{"name":"ClickFix-Themed Campaign Deploys Starland RAT and WLDR Framework","url":"https://otx.alienvault.com/pulse/6a72c0dda246e779e90b7a68","created":"2026-08-05"},{"name":"NightLedger Backdoor Deployed in Espionage Campaign Targeting the Middle East and Africa","url":"https://otx.alienvault.com/pulse/6a71aa488c89bfcbd2814692","created":"2026-08-04"},{"name":"ClickFix-Themed Campaign Deploys Starland RAT and WLDR Framework","url":"https://otx.alienvault.com/pulse/6a71a6ac7bd8297ea6d2093f","created":"2026-08-04"},{"name":"Beyond Banking Trojans: Rokarolla Expands the Android Fraud Playbook.","url":"https://otx.alienvault.com/pulse/6a45258803f37c6571d791c1","created":"2026-07-01"}],"provenance":"machine"},"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"}],"references":[{"url":"https://www.vmware.com/security/advisories/VMSA-2021-0002.html","tags":["x_refsource_CONFIRM"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-21-250/","tags":["x_refsource_MISC"]},{"url":"http://packetstormsecurity.com/files/162957/VMware-ESXi-OpenSLP-Heap-Overflow.html","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[{"id":"SRC-18fd26fa020f9a3dac70","title":"The Tortoise and The Malwahare","publisher":"pwc.com","url":"https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/tortoise-and-malwahare.html","date":null,"mentions":[{"quote":"We assess that Teal Kurma has likely continued leveraging major CVEs in its current campaigns, particularly ones with publicly available proof-of-concept code such as CVE-2021-44228, CVE-2021-21974, and CVE-2022-0847.","start":6231,"end":6448},{"quote":"It is highly plausible that the threat actor is also using other code observed on this GitHub, particularly some of the proof-of-concept exploit code for major vulnerabilities, such as CVE-2021-21974 or a ESXi OpenSLP heap-overflow vulnerability.","start":12386,"end":12632}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-9145","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-9145","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":6,"skipped":1,"earliest":"2021-05-25","earliestUrl":"https://github.com/Shadow0ps/CVE-2021-21974","repos":[{"name":"Shadow0ps/CVE-2021-21974","url":"https://github.com/Shadow0ps/CVE-2021-21974","stars":188,"created":"2021-05-25"},{"name":"Aiyakami/CVE-2021-21974","url":"https://github.com/Aiyakami/CVE-2021-21974","stars":6,"created":"2026-07-08"},{"name":"n2x4/Feb2023-CVE-2021-21974-OSINT","url":"https://github.com/n2x4/Feb2023-CVE-2021-21974-OSINT","stars":2,"created":"2023-02-04"},{"name":"CYBERTHREATANALYSIS/ESXi-Ransomware-Scanner-mi","url":"https://github.com/CYBERTHREATANALYSIS/ESXi-Ransomware-Scanner-mi","stars":2,"created":"2023-02-08"},{"name":"hateme021202/cve-2021-21974","url":"https://github.com/hateme021202/cve-2021-21974","stars":0,"created":"2023-10-19"}]},"first":{"date":"2021-05-25","source":"PoC-in-GitHub","url":"https://github.com/Shadow0ps/CVE-2021-21974"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/162957/VMware-ESXi-OpenSLP-Heap-Overflow.html"],"flow":[],"timeline":[{"date":"2021-02-24","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2021-21974","provenance":"source"},{"date":"2021-05-25","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/Shadow0ps/CVE-2021-21974","provenance":"source"},{"date":"2023-02-03","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cert.ssi.gouv.fr/alerte/CERTFR-2023-ALE-015/","provenance":"source"}],"speed":{"daysToPublicExploit":90,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":82.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1364 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.76,"detail":"percentile 0.9878"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD exploit link; 6 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}