CVE-2020-3992

💻 Affected Systems

📦 What is this software?

⚠️ Risk & Real-World Impact

🎯 Exploit Status

Exploit requires network access to port 427 but no authentication. Multiple advisories and PoCs exist.

🔍 How to Verify

Check ESXi version: esxcli system version get. Compare against vulnerable versions listed in advisory.

esxcli system version get

Verify patch installation: esxcli software vib list | grep -i openslp. Check version matches patched versions.

📡 Detection & Monitoring

source="ESXi" AND (port=427 OR process="slpd") AND (action="deny" OR action="block" OR severity="high")

🔗 References

• https://www.vmware.com/security/advisories/VMSA-2020-0023.html Patch,Vendor Advisory
• https://www.zerodayinitiative.com/advisories/ZDI-20-1377/ Third Party Advisory,VDB Entry
• https://www.zerodayinitiative.com/advisories/ZDI-20-1385/ Third Party Advisory,VDB Entry
• https://www.vmware.com/security/advisories/VMSA-2020-0023.html Patch,Vendor Advisory
• https://www.zerodayinitiative.com/advisories/ZDI-20-1377/ Third Party Advisory,VDB Entry
• https://www.zerodayinitiative.com/advisories/ZDI-20-1385/ Third Party Advisory,VDB Entry
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3992 US Government Resource