CVE-2021-21974
HIGH 8.8EPSS 45.1%
OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overflow vulnerability. A malicious actor residing within the same network segment as ESXi who has access to port 427 may be able to trigger the heap-overflow issue in OpenSLP service resulting in remote code execution.
- CVSS v3.1
- 8.8 HIGH
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v3.1
- 8.8 HIGH
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v2.0
- 5.8 MEDIUM
AV:A/AC:L/Au:N/C:P/I:P/A:P - EPSS
- 45.06% chance of exploitation in the next 30 days, 99th percentile
- Published
- 2021-02-24
- Updated
- 2026-06-02
Proof-of-concept exploits (7)
- http://packetstormsecurity.com/files/162957/VMware-ESXi-OpenSLP-Heap-Overflow.html
- Shadow0ps/CVE-2021-21974185★ · 2026-03-10
- abirasecurity/CVE-2021-21974_vuln_dectection0★ · 2025-09-04
- hateme021202/cve-2021-219740★ · 2023-10-19
- mercylessghost/CVE-2021-219740★ · 2025-01-10
- n2x4/Feb2023-CVE-2021-21974-OSINT2★ · 2023-02-06
- Aiyakami/CVE-2021-21974