CVE-2021-21974

HIGHRansomware

VMware cloud_foundation Out-of-bounds Write

Title source: VulnCheck
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2021-21974 has a selected CVSS score of 8.8 (high); EIP currently links 8 repository PoCs. VulnCheck reports CVE-2021-21974 use in known ransomware campaigns.

Description

OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overflow vulnerability. A malicious actor residing within the same network segment as ESXi who has access to port 427 may be able to trigger the heap-overflow issue in OpenSLP service resulting in remote code execution.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Feb 3, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck
Ransomware use
Observed · VulnCheck

Available material

Repository PoCs
8

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 2, 2026 · Source: CVE List

Affected products and versions

3
ProductSourceVersion range

cloud_foundation

Browse VMware / cloud_foundation
VulnCheckVersion data not supplied

VMware Cloud Foundation

CVE List4.x before 4.2 and 3.xaffected

VMware ESXi

CVE List7.0 before ESXi70U1c-17325551affected
6.7 before ESXi670-202102401-SGaffected
6.5 before ESXi650-202102101-SGaffected

Proofs of concept

8

Repository PoCs

GitHubabirasecurity/CVE-2021-21974_vuln_dectectionRepository PoCby abirasecurity0Scanner2 files

12.1 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python-based scanner that checks for the CVE-2021-21974 vulnerability in VMware ESXi SLP services by probing service availability, fingerprinting the implementation, and testing boundary/malformed packet handling without performing exploitation.

Backdoor review

No backdoor observed in reviewed code

The artifact is a Python script and README that perform safe, non-exploitative detection of CVE-2021-21974. The code sends crafted SLP packets to a user-supplied target to fingerprint the service and test boundary/malformed packet handling, but it does not execute any payload, establish persistence, exfiltrate data, or contact any attacker-controlled infrastructure. No concealed or deceptive behavior was found.

ClassificationScanner
Model confidence98%
AuthenticationNot required
Languagespython
Target softwareVMware ESXiOpenSLP
Attack typesvulnerability scanning
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a scanner because it only detects, validates, and reports exposure to CVE-2021-21974 without exploiting the vulnerability. The code explicitly states it is a 'Safe PoC that identifies vulnerable SLP implementations without exploitation' and performs non-destructive checks like service probing, fingerprinting, and boundary testing.

CVE-2021-21974_detector.py:3-4README.md:3README.md:15

Requirements

  • Network access to target on port 427CVE-2021-21974_detector.py:14-16
  • Python 3.x with standard librariesREADME.md:29-35

Observed behavior

  • Connects to target on port 427 and sends a basic SLP service request to check availabilityCVE-2021-21974_detector.py:68-91
  • Sends SLP Directory Agent Advertisement packets with varying URL and scope lengths to test boundary conditionsCVE-2021-21974_detector.py:93-133
  • Sends malformed SLP packets to evaluate error handlingCVE-2021-21974_detector.py:135-158
  • Fingerprints SLP implementation by analyzing response version and function IDCVE-2021-21974_detector.py:160-192
  • Assesses vulnerability likelihood based on detected implementation and reports resultsCVE-2021-21974_detector.py:194-247
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Connection
Payload withheldThe script connects to the target specified by the user to perform vulnerability detection. This is expected behavior for a PoC scanner and is not a backdoor.CVE-2021-21974_detector.py:14-16CVE-2021-21974_detector.py:71-73
User Input
Payload withheldThe script takes a target IP address as a command-line argument. No hidden or hardcoded targets are present.CVE-2021-21974_detector.py:250-254
Review boundaries

What the analysis did not establish

  • Review is limited to the supplied text files (CVE-2021-21974_detector.py and README.md). No binary files were present or analyzed.
  • The script's behavior depends on the target's response; the review does not assess the safety of running the script against a malicious target that could exploit the scanner itself, though no such vulnerability is apparent in the code.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubAiyakami/CVE-2021-21974Repository PoCby Aiyakami5Exploit4 files

344.7 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that exploits CVE-2021-21974, a heap overflow in VMware ESXi's OpenSLP service, to achieve remote code execution. The script performs heap manipulation, information leaks, and overwrites __free_hook with system() to execute an arbitrary command.

Backdoor review

No backdoor observed in reviewed code

The PoC is a single-file Python exploit for CVE-2021-21974 that targets a heap overflow in VMware ESXi OpenSLP to achieve remote code execution. All observed behavior is consistent with a legitimate exploit: it constructs SLP protocol packets, performs heap manipulation, leaks memory, overwrites __free_hook with system, and triggers execution of a hardcoded command. No concealed backdoor, credential theft, persistence, or unrelated payload was found. The code includes optional SSH helpers for lab automation, but these are clearly documented and disabled by default.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagespython
Target softwareVMware ESXiOpenSLP
Attack typesheap overflowremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete, single-file Python script that implements a multi-stage exploit against a specific vulnerability (CVE-2021-21974). It performs heap manipulation, information leaks, and overwrites a function pointer to hijack execution flow and run an arbitrary command on the target. The README confirms it is a 'PoC' for remote code execution.

CVE-2021-21974.py:1-1298README.md:3README.md:50

Requirements

  • Target must be running a vulnerable version of VMware ESXi with the OpenSLP service (slpd) accessible on port 427.README.md:9CVE-2021-21974.py:473-474
  • The exploit is tuned for a specific ESXi 6.7 build (14320388) and its associated glibc version; different environments require parameter adjustments.README.md:18README.md:60

Observed behavior

  • Connects to the target's SLP service on port 427 and sends a series of crafted SLP packets to manipulate the heap layout.CVE-2021-21974.py:942-992
  • Leaks heap and libc addresses by reading data from a connected socket after triggering the overflow.CVE-2021-21974.py:1000-1001CVE-2021-21974.py:1006CVE-2021-21974.py:1013-1014
  • Performs an arbitrary read of the free@GOT entry to calculate the libc base address.CVE-2021-21974.py:1027CVE-2021-21974.py:1037-1038
  • Locates a saved SLPBuffer on the heap and writes the command string and a pointer to system() into __free_hook.CVE-2021-21974.py:1061CVE-2021-21974.py:1069-1070
  • Triggers the overwritten __free_hook by sending an SrvDeReg packet, causing the target to execute the attacker's command.CVE-2021-21974.py:1077-1081
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Command Execution
Payload withheldHardcoded command executed on the target via the exploit chain; matches the stated PoC purpose.CVE-2021-21974.py:475
Ssh Automation
Payload withheldOptional SSH-based result verification and remote restart helpers; disabled by default (AUTO_RESTART_REMOTE=False, AUTO_READ_LIBC_BASE_VIA_SSH=False).CVE-2021-21974.py:494-502
Target Configuration
Payload withheldHardcoded target IP; typical for a PoC and not indicative of backdoor behavior.CVE-2021-21974.py:473
Review boundaries

What the analysis did not establish

  • The evidence includes two non-text media files (test_result_1.png, test_result_2.png) that were not analyzed; their content could provide additional confirmation of exploit success.
  • The analysis is based solely on static review of the provided source code and documentation; the code was not executed, and its behavior on a live target is not verified.
  • Two non-text media files (test_result_1.png, test_result_2.png) were present in the repository but not analyzed; they are screenshots of test results and unlikely to contain executable backdoor behavior.
  • The review is limited to the supplied text evidence; binary content was flagged as metadata-only and not inspected.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubHynekPetrak/CVE-2019-5544_CVE-2020-3992Repository PoCby HynekPetrak49Not analyzed4 files

23.2 KiB · linked to 3 vulnerabilities

GitHub
PoC details
GitHubShadow0ps/CVE-2021-21974Repository PoCby Shadow0ps185Not analyzed2 files

18.1 KiB

GitHub
PoC details
GitHubn2x4/Feb2023-CVE-2021-21974-OSINTRepository PoCby n2x42Not analyzed6 files

125.3 KiB

GitHub
PoC details
GitHubCYBERTHREATANALYSIS/ESXi-Ransomware-Scanner-miRepository PoCby CYBERTHREATANALYSIS2Not analyzed2 files

5.7 KiB

GitHub
PoC details
GitHubhateme021202/cve-2021-21974Repository PoCby hateme0212020Not analyzed1 file

14.0 KiB

GitHub
PoC details
GitHubmercylessghost/CVE-2021-21974Repository PoCby mercylessghost0Not analyzed3 files

7.5 KiB

GitHub
PoC details

References

4