[update]Two year old vulnerability used in ransomware attack against VMware ESXi

🗓️ 06 Feb 2023 04:00:00Reported by Malwarebytes blogType

malwarebytes🔗 www.malwarebytes.com👁 128 Views

A ransomware attack targeted VMware ESXi virtual machines using an old vulnerability (CVE-2021-21974) allowing remote code execution. Organizations are advised to apply the latest security updates and disable the OpenSLP service if not in use

Reporter	Title	Published	Views	Family All 106
zdt	VMware ESXi OpenSLP Heap Overflow Exploit	3 Jun 202100:00	–	zdt
IBM Security Bulletins	Security Bulletin: Vulnerability identified in VMware component affects Cloud Pak System (CVE-2021-21974)	20 Mar 202311:30	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities identified in VMWare ESXi shipped with IBM Cloud Pak System	31 Mar 202314:38	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in VMware vCenter affect IBM Cloud Pak System (CVE-2022-31697, CVE-2022-31698)	31 Mar 202314:35	–	ibm
GithubExploit	Exploit for Out-of-bounds Write in Vmware Cloud_Foundation	25 May 202117:14	–	githubexploit
GithubExploit	Exploit for Out-of-bounds Write in Vmware Cloud_Foundation	10 Jan 202518:00	–	githubexploit
GithubExploit	Exploit for Out-of-bounds Write in Vmware Cloud_Foundation	4 Sep 202517:29	–	githubexploit
ATTACKERKB	CVE-2021-21974	24 Feb 202117:15	–	attackerkb
BDU FSTEC	The vulnerability of the OpenSLP service of the VMware ESXi hypervisor allows a attacker to execute arbitrary code.	25 Feb 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the network socket of the VMware ESXi hypervisor allows a attacker to execute arbitrary code with elevated privileges.	12 Dec 202200:00	–	bdu_fstec

06 Feb 2023 04:00Current

1.1Low risk

Vulners AI Score1.1

EPSS0.47795