Ransomwarehigh
ESXiArgs Ransomware Targets Publicly-Exposed ESXi OpenSLP Servers
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-3992 | Use-After-Free RCE in VMware ESXi OpenSLP Service (Port 427) | 9.8 | 83% | KEVRansomware | KEV |
| CVE-2021-21974 | OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overflow vulnerability | 8.8 | 45% | PoC |
From the original article
3 min read at recordedfuture.com
An ongoing ransomware campaign dubbed ESXiArgs is targeting outdated VMware ESXi installations. While first reports surfaced on Friday, February 3rd, a more significant wave infected at least 2,000 hosts over the weekend, according to BleepingComputer . An internet-wide scan reported up to 8,000 infected hosts as of this writing.
By German Hoeffner, Aaron Soehnen & Gianni Perez · recordedfuture.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.