Back to Vulnerabilities
CVE-2023-20892
Critical
ESXi
VMware ESXi Remote Code Execution Vulnerability
Sarah Johnson
5921 views
Summary
A critical remote code execution vulnerability in VMware ESXi allows attackers to execute arbitrary code on affected systems.
Description
VMware ESXi contains a heap overflow vulnerability in the OpenSLP service that could allow a remote attacker to execute code as the root user on an affected system. The OpenSLP service is enabled by default on ESXi hosts and is used for service discovery on the network.
This vulnerability is particularly severe as it can be exploited remotely without authentication and can lead to complete system compromise.
Affected Products
- ESXi 8.0 before ESXi80U1c-21360656
- ESXi 7.0 before ESXi70U3p-21717919
- ESXi 6.7 before ESXi670-202307101-SG
CVSS Score
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HAbout the Author
Sarah Johnson
Security Engineer
Sarah is a security engineer specializing in virtualization and cloud infrastructure security.