A two-year-old fix that many hosts never installed. In February 2023 the ESXiArgs ransomware encrypted thousands of exposed ESXi servers.
Publicly disclosed: 23 February 2021
On 23 February 2021 VMware fixed a heap overflow in the OpenSLP service of ESXi (port 427). An attacker who could reach that port could execute code on the hypervisor. Exactly two years later, in February 2023, the ESXiArgs ransomware campaign scanned the internet for ESXi hosts with SLP exposed and encrypted the virtual machines of thousands of organizations — almost all of them unpatched and directly reachable from the internet.
| CVE | Severity | Affected | Fixed in |
|---|---|---|---|
CVE-2021-21974 | High, CVSS 8.8 (heap overflow, remote code execution) | ESXi 7.0 before U1c, 6.7 and 6.5 before February 2021 patches | ESXi 7.0 U1c, ESXi670-202102401-SG, ESXi650-202102101-SG and later |
slpd service and disable the CIMSLP firewall ruleset, as VMware describes in its knowledge base.A patch that is two years old protects nobody if it was never installed.
Sources: VMware VMSA-2021-0002, NVD CVE-2021-21974.
Need help with this? Contact CySec for a free consultation.
A newly disclosed exploit chain gives attackers root on on-premises N-central servers; attacks began hours after the proof of concept. No complete fix yet — immediate checks.
Read articleAn exploited Outlook flaw leaks NTLM password hashes from a crafted file. Microsoft fixed over 1,000 vulnerabilities this month — here is what to prioritise.
Read articleGoogle fixed a use-after-free in Chrome that is already exploited. The fix only works after the browser restarts — here is how to make sure every PC is protected.
Read articleOur engineers can review your current setup and propose concrete improvements.