CVE-2020-3992

VMware ESXi

Published 20 Oct 2020 · updated 12 Aug 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 3 Nov 2021, with a remediation deadline of 3 May 2022 for US federal agencies. It has been used in ransomware campaigns.

Required action: Apply updates per vendor instructions.

Description

OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue. A malicious actor residing in the management network who has access to port 427 on an ESXi machine may be able to trigger a use-after-free in the OpenSLP service resulting in remote code execution.

References

www.vmware.com/security/advisories/VMSA-2020-0023.html · Patch, Vendor Advisory
www.zerodayinitiative.com/advisories/ZDI-20-1377/ · Third Party Advisory, VDB Entry
www.zerodayinitiative.com/advisories/ZDI-20-1385/ · Third Party Advisory, VDB Entry
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3992 · US Government Resource