Intel

CVE-2019-5544

VMware VMware ESXi and Horizon DaaS — VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability

criticalRansomwareKEV: actively exploitedPoCEPSS 97%

Description

OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.

Source: CISA_KEVNVDCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2019-5544 carries a CVSS 9.8 score (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning a network-adjacent or internet-exposed attacker needs no credentials and no user interaction to achieve full remote code execution on the hypervisor via a single heap overflow in OpenSLP. With an EPSS score at the 99th percentile (97.26 %), the probability of active exploitation attempts against any exposed instance is extremely high, and CISA has confirmed use in ransomware campaigns — attackers compromise the hypervisor layer to encrypt all guest VMs simultaneously, causing total production outages. For NIS2-scoped organisations, any ESXi host with port 427 reachable — even from internal segments — must be treated as critically exposed and remediated within the 24-hour window through patching or OpenSLP deactivation; the blast radius of a successful attack extends to every workload running on the affected host.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply the vendor patch: VMware Security Advisory VMSA-2019-0022 covers ESXi (6.0, 6.5, 6.7) and Horizon DaaS (8.x–9.0.0.0) — retrieve the exact build numbers from the advisory and deploy immediately across all affected hosts.
  • Block port 427 (TCP/UDP): Drop all inbound traffic to port 427 (SLP) at the perimeter firewall and on distributed vSphere switches for every ESXi management network. No legitimate external access to this port is required.
  • Disable the OpenSLP service: On any host that cannot be patched immediately, shut down OpenSLP as a compensating control: esxcli system wbem set --enable false and chkconfig slpd off, then reboot the host to ensure the service is fully terminated.
  • Inventory and triage: Enumerate all ESXi hosts and Horizon DaaS appliances, confirm version and patch status, and prioritise by criticality — KRITIS/NIS2-critical assets first.
  • Verify network segmentation: Confirm that ESXi management interfaces (VMkernel ports) are reachable only from a dedicated out-of-band management VLAN and are not accessible from production networks or the internet.

Runbook · Step 2

Mitigation layers

  • Network layer: Enforce a DROP rule for TCP/UDP dport 427 on all perimeter and internal segmentation firewalls, permitting only explicitly whitelisted management hosts. On NSX-T/NSX-V, apply an equivalent Distributed Firewall rule scoped to ESXi management groups.
  • IPS/IDS signature: Configure Suricata or Snort to alert on anomalous SLP traffic on port 427 — specifically oversized SLP attribute fields (heuristic: payload > 1400 bytes on port 427). Check for and enable any available community signatures referencing CVE-2019-5544.
  • Least privilege / access control: Restrict vCenter-to-ESXi access to named service accounts; disable direct SSH logins on ESXi hosts unless required for emergency access. Enable ESXi Lockdown Mode to reduce the attack surface.
  • Horizon DaaS isolation: Run Horizon DaaS appliances (8.0.0–9.0.0.0) in an isolated management segment and additionally block port 427 at the host firewall level using esxcli network firewall rules on each appliance.
  • Compensating monitoring: Until the patch is deployed, enable continuous NetFlow or sFlow monitoring on port 427 and configure alerting for any connection attempt from unauthorised sources.

Runbook · Step 3

Detection rules

  • Network telemetry (Zeek/Suricata): Alert on any TCP/UDP connection to port 427 on ESXi management IPs originating outside the designated management VLAN. KQL: NetworkEvents | where DestPort == 427 and not(SourceIP in (management_ip_list)).
  • ESXi syslog: Monitor for unexpected restarts of the slpd process or kernel panic entries in /var/log/vmkernel.log temporally correlated with SLP connection events — this pattern is consistent with a heap overflow triggering a service crash or code execution.
  • EDR/process telemetry: On Horizon DaaS appliances, flag any child process spawned by slpd — process ancestry slpd -> /bin/sh or any unknown binary is a high-fidelity post-exploitation indicator.
  • vCenter event log: Alert on unexpected VM creation, snapshot operations, or ESXi host configuration changes that lack a corresponding change ticket — these are plausible post-exploitation actions following successful RCE on the hypervisor.
  • Sigma rule shape: title: SLP Port 427 Access to ESXi | logsource: category: network_connection | detection: selection: dst_port: 427 | condition: selection — scope to ESXi destination IPs in your SIEM.

Metrics

Severity
critical
Priority score
209.42
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
9.8
Source: nvd-v3
CVSS v3
9.8
CVSS v4
—
EPSS percentile
99.9 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
97.3 %
High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
Published
2021-11-03 00:00 UTC
CWE
—

Affected operating systems

  • linux

    redhat / enterprise_linux_desktop6.0

  • linux

    redhat / enterprise_linux_desktop7.0

  • linux

    redhat / enterprise_linux_for_ibm_z_systems6.0_s390x

  • linux

    redhat / enterprise_linux_for_ibm_z_systems7.0_s390x

  • linux

    redhat / enterprise_linux_for_ibm_z_systems_eus7.7_s390x

  • linux

    redhat / enterprise_linux_for_power_big_endian6.0_ppc64

  • linux

    redhat / enterprise_linux_for_power_big_endian7.0_ppc64

  • linux

    redhat / enterprise_linux_for_power_big_endian_eus7.7_ppc64

  • linux

    redhat / enterprise_linux_for_power_little_endian7.0_ppc64le

  • linux

    redhat / enterprise_linux_for_power_little_endian_eus7.7_ppc64le

  • linux

    redhat / enterprise_linux_server6.0

  • linux

    redhat / enterprise_linux_server7.0

  • linux

    redhat / enterprise_linux_server_aus7.7

  • linux

    redhat / enterprise_linux_server_eus7.7

  • linux

    redhat / enterprise_linux_server_tus7.7

  • linux

    redhat / enterprise_linux_workstation6.0

  • linux

    redhat / enterprise_linux_workstation7.0

  • other

    vmware / esxi6.0

  • other

    vmware / esxi6.5

  • other

    vmware / esxi6.7

  • other

    fedoraproject / fedora30

  • other

    fedoraproject / fedora31

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • openslp

    openslp2.0.0

  • vmware

    horizon_daas8.0.0 – 9.0.0.0

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

IDCVE-2019-5544