CVE-2020-3992

Think of OpenSLP as a network-facing “communication” service inside VMware ESXi. This bug is like grabbing memory, freeing it, and then using it again—an attacker can take advantage of that to run their own code on the host. If exploited, it can lead to full control of the ESXi environment and enable ransomware.

This matters if your business runs VMware ESXi (or VMware Cloud Foundation, which includes ESXi components) and the OpenSLP service is reachable from your management network. The key gating condition is network access to port 427 on the ESXi machine. The risk is only present if an attacker can reach that port from the management network.

Red: this vulnerability has been added to CISA’s KEV catalog and has been used in ransomware campaigns. Attackers can exploit it remotely over the network (no authentication required), so delaying patching meaningfully increases the chance of compromise. Act immediately to get to the fixed versions.

1. Confirm exposure and reachability

   • Identify which ESXi hosts (and ESXi components inside VMware Cloud Foundation) are running.
   • Check whether port 427 is reachable to those hosts from any untrusted network segment or systems within your management network.
   • Document which network paths can reach port 427.

2. Confirm whether you’re on a vulnerable version

   • VMware ESXi 7.0 is vulnerable if it is before ESXi_7.0.1-0.0.16850804.
   • VMware ESXi 6.7 is vulnerable if it is before ESXi670-202010401-SG.
   • VMware ESXi 6.5 is vulnerable if it is before ESXi650-202010401-SG.
   • If you run VMware Cloud Foundation, use the Cloud Foundation fix guidance (fixed in 3.10.1.2).

3. Apply the vendor fix

   • Upgrade VMware Cloud Foundation to 3.10.1.2 (if applicable).
   • Otherwise, upgrade VMware ESXi to the fixed versions indicated by VMware’s security advisory for VMSA-2020-0023.
   • Plan the upgrade using VMware’s normal maintenance procedures for ESXi/Cloud Foundation to minimize downtime.

4. Compensating control if you cannot patch right away

   • Immediately restrict network access so that port 427 on the ESXi host is not reachable from systems outside the tightly controlled management network.
   • If you can, block/deny inbound connections to port 427 at the network firewall/segmentation layer until patching is complete.

5. Validate after patching

   • Re-check ESXi version numbers to ensure they are on fixed builds.
   • Confirm that port 427 is no longer broadly reachable (only from approved management sources).

6. What to monitor

   • Look for signs of suspicious remote activity around the time of changes and around unusual traffic targeting port 427.
   • Since this issue is known to be used in ransomware campaigns, also monitor for post-compromise indicators in your environment (unexpected account creation, service/process anomalies, and lateral movement attempts).

CVE-2020-3992 is a critical use-after-free (CWE-416) in OpenSLP as used in VMware ESXi. The attack is network-based and does not require authentication or user interaction; exploitation requires the attacker to be in the management network and have access to port 427 on an ESXi machine. CISA added it to its KEV catalog (listed as used in ransomware campaigns), which means there is confirmed real-world exploitation and organizations should treat exposure as urgent. Vendor guidance calls for applying updates per the referenced VMware security advisory. Exploit maturity is indicated as weaponized enough for ransomware use (per KEV); specific exploit details are not provided in the findings.