{"id":23126,"date":"2023-02-23T01:21:38","date_gmt":"2023-02-23T01:21:38","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=23126"},"modified":"2026-04-17T18:07:42","modified_gmt":"2026-04-17T18:07:42","slug":"esxiargs-ransomware-attack-event-analysis","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/esxiargs-ransomware-attack-event-analysis\/","title":{"rendered":"ESXiArgs Ransomware Attack Event Analysis"},"content":{"rendered":"\n


The French Computer Emergency Response Team (CERT-FR) warned that [1]<\/sup> an attacker exploited a two-year-old remote code execution vulnerability in VMware ESXi server to deploy new ESXiArgs ransomware. The security vulnerability number is CVE-2021-21974 [2]<\/sup> and it is caused by a heap overflow vulnerability in the OpenSLP service. Unauthenticated attackers can use this vulnerability to launch attacks very easily.<\/p>\n\n\n\n

Vulnerability (CVE-2021-21974) Information<\/strong><\/h2>\n\n\n\n

If an attacker is on the same network segment as ESXi and can access port 427, he or she can trigger a heap overflow vulnerability in the OpenSLP service by sending a constructed malicious request packet to port 427, ultimately causing remote code execution. In February 2021, VMware discovered the relevant program vulnerabilities and released patches. In addition, the PoC of this vulnerability has already been disclosed. The recent attack is targeted at unpatched products. The vulnerability CVE-2021-21974 affects the following systems:<\/p>\n\n\n\n