CVE-2020-3992

CVE-2020-3992 is a critical-severity (CVSS 9.8) vulnerability in VMware ESXi. CISA added it to the Known Exploited Vulnerabilities catalog on November 3, 2021, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by May 3, 2022. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. VMware has 26 vulnerabilities in the KEV catalog, 9 of them linked to ransomware.

OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue. A malicious actor residing in the management network who has access to port 427 on an ESXi machine may be able to trigger a use-after-free in the OpenSLP service resulting in remote code execution.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• https://www.vmware.com/security/advisories/VMSA-2020-0023.html
• https://www.zerodayinitiative.com/advisories/ZDI-20-1377/
• https://www.zerodayinitiative.com/advisories/ZDI-20-1385/
• https://www.vmware.com/security/advisories/VMSA-2020-0023.html
• https://www.zerodayinitiative.com/advisories/ZDI-20-1377/
• https://www.zerodayinitiative.com/advisories/ZDI-20-1385/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3992