CVE-2019-5544: VMware ESXi & Horizon DaaS OpenSLP Heap‑Based Buffer Overflow Enables Remote Code Execution
What It Is — OpenSLP in VMware ESXi and Horizon Desktop‑as‑a‑Service contains a heap‑based buffer overflow. An attacker who can reach TCP/UDP port 427 can corrupt the service’s heap and execute arbitrary code on the host.
Exploitability — Publicly disclosed in 2019; proof‑of‑concept code is available; CVSS v3.1 base score 9.8 (Critical). No widespread active exploits reported, but the vulnerability is trivial to weaponize.
Affected Products — VMware ESXi hypervisor (all supported versions at time of disclosure) and VMware Horizon DaaS deployments that expose the OpenSLP service.
Why It Matters for Trust & Control Assurance
- Continuous monitoring of network‑exposed services and timely patching provide auditable evidence that satisfies a single control objective across SOC 2, ISO 27001, NIST CSF, and others.
- Demonstrates the effectiveness of a vulnerability‑management program, a cornerstone of a defensible audit trail for enterprise buyers.
- Mapping remediation to the “Vulnerability Management” control area reinforces a unified trust signal across multiple compliance frameworks.
Recommended Actions
- Verify whether port 427 is required; if not, block it at the firewall or disable OpenSLP.
- Apply VMware’s security patch (VMware Security Advisory VMSA‑2019‑0010) to all ESXi and Horizon DaaS hosts.
- Update your vulnerability‑management inventory and capture remediation evidence for audit purposes.
- Incorporate the patch status into continuous compliance dashboards.
Source: CISA KEV – CVE‑2019‑5544