Critical Use‑After‑Free in VMware ESXi (CVE‑2020‑3992) Enables Remote Code Execution via OpenSLP
What It Is – VMware ESXi’s OpenSLP service contains a use‑after‑free flaw (CVE‑2020‑3992) that can be triggered by sending crafted packets to TCP/UDP port 427.
Exploitability – The vulnerability is remotely exploitable from the management network; proof‑of‑concept code is publicly available. CVSS v3.1 base score 9.8 (Critical).
Affected Products – VMware ESXi 6.5 U3, 6.7 U2 and later releases that include the OpenSLP component.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for a patch‑management and secure configuration control that spans inventory, timely remediation, and verification – a single control objective that satisfies many frameworks (e.g., NIST CSF PR.IP‑12, ISO 27001 A.12.6).
- Unpatched hypervisors give attackers a foothold inside the data‑center, breaking the audit trail of “only authorized code runs” and eroding continuous‑monitoring evidence.
- Enterprise buyers now demand demonstrable evidence that such critical OS‑level flaws are tracked, mitigated, and documented in a trusted control repository.
Recommended Actions
- Verify ESXi inventory and confirm which hosts run a vulnerable version of OpenSLP.
- Apply VMware’s security patch (or disable the OpenSLP service if not required) and document the change in your configuration‑management system.
- Update your vulnerability‑remediation workflow to include continuous scanning for CVE‑2020‑3992 and map the remediation to the “patch management” control objective.
Source: CISA KEV – CVE‑2020‑3992