CVE-2021-21974

State: Published
Severity: 8.8 High
Published: Feb 24, 2021
Updated: Jun 2, 2026
Reserved: Jan 4, 2021

Description

OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overflow vulnerability. A malicious actor residing within the same network segment as ESXi who has access to port 427 may be able to trigger the heap-overflow issue in OpenSLP service resulting in remote code execution.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-787 Out-of-bounds Write

Affected Products

Product	Versions
VMware ESXin/a	7.0 before ESXi70U1c-17325551Affected 6.7 before ESXi670-202102401-SGAffected 6.5 before ESXi650-202102101-SGAffected
VMware Cloud Foundationn/a	4.x before 4.2 and 3.xAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.