Vulnerability (CVE)
A ransomware campaign tracked as ESXiArgs targeted VMware ESXi hypervisors running versions 6.x and before 6.7, exploiting a heap-overflow vulnerability in OpenSLP tracked as CVE-2021-21974, with related flaws CVE-2020-3992 and CVE-2021-21974 in the SLP...
GreyNoise's May 24 to June 4, 2021 tag roundup added tags for VMware vSphere Client RCE attempts and vulnerability checks tied to CVE-2021-21985, and for VMware ESXi OpenSLP RCE attempts exploiting CVE-2021-21974. The post also updated an Elasticsearch RCE...
GreyNoise examined the ESXiArgs ransomware campaign, which creates files with a .args extension and was flagged by OVH on February 3rd, 2023, and found that while third-party sources attribute it to CVE-2021-21974, a heap-overflow flaw in VMware ESXi's...