CVE-2020-3992
CRITICAL KEV RANSOMWAREVMware ESXi < 7.0.1-0.0.16850804, < 6.7 ESXi670-202010401-SG, < 6.5 ESXi650-202010401-SG - Use-After-Free in OpenSLP
Title source: llmExploitation Summary
CVE-2020-3992 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021, with confirmed use in ransomware campaigns. EIP tracks 3 public exploits from researchers including dgh05t, HynekPetrak.
AI-analyzed exploit summary This repository contains proof-of-concept exploits for CVE-2019-5544 and CVE-2020-3992, both targeting VMware ESXi's OpenSLP service. The exploits leverage heap overflow and memory corruption vulnerabilities to potentially achieve remote code execution or denial of service.
Description
OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue. A malicious actor residing in the management network who has access to port 427 on an ESXi machine may be able to trigger a use-after-free in the OpenSLP service resulting in remote code execution.
Exploits (3)
This repository contains proof-of-concept exploits for CVE-2019-5544 and CVE-2020-3992, both targeting VMware ESXi's OpenSLP service. The exploits leverage heap overflow and memory corruption vulnerabilities to potentially achieve remote code execution or denial of service.
This repository contains a Python script that scans for OpenSLP services, which may be vulnerable to CVE-2019-5544 and CVE-2020-3992. The script uses the Scapy library to send SLP protocol packets and detect services, but it does not exploit the vulnerabilities.
The repository contains a functional Python script that exploits CVE-2020-3992 by sending a crafted packet to a vulnerable VMware ESXi server on port 427. The exploit triggers a denial-of-service (DoS) condition by sending multiple malformed packets.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H