The flaw is a heap-overflow vulnerability in OpenSLP as used in ESXi, affecting the OpenSLP service in the ESXi hypervisor product line. An attacker on the same network segment as ESXi with access to port 427 can trigger the overflow in the OpenSLP service, which may lead to remote code execution without authentication or user interaction.
OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overflow vulnerability. A malicious actor residing within the same network segment as ESXi who has access to port 427 may be able to trigger the heap-overflow issue in OpenSLP service resulting in remote code execution.
First seen exploited 23 months after disclosure. Public exploit code (PoC-in-GitHub) appeared 3 months after disclosure.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
Reports are matched by finding the exact id CVE-2021-21974 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
It is highly plausible that the threat actor is also using other code observed on this GitHub, particularly some of the proof-of-concept exploit code for major vulnerabilities, such as CVE-2021-21974 or a ESXi OpenSLP heap-overflow vulnerability.
2 passages name itOriginal (opens in a new tab) ↗
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.