VMware ESXi OpenSLP CVE-2021-21974 (heap overflow behind the ESXiArgs ransomware wave, CISA KEV): how do I check old ESXi hosts, disable SLP and patch?

What it is: CVE-2021-21974 is a heap overflow in the OpenSLP service on VMware ESXi, reachable over port 427. Someone on the same network segment (or on the internet, if the port is exposed) can use it to run code on the host. VMware fixed it in VMSA-2021-0002 in February 2021. Two years later, the ESXiArgs ransomware campaign (February 2023) mass-encrypted thousands of internet-exposed, unpatched ESXi hosts, most likely through this bug, and CISA and the FBI published recovery guidance (AA23-039A). Old ESXi hosts with SLP exposed are still targeted by ransomware groups. Am I affected: - ESXi 6.5, 6.7 or 7.0 builds older than the VMSA-2021-0002 patches, with the SLP service running. Those releases are all end of general support now, so they also miss many later fixes. - Check the build with esxcli system version get, and whether SLP is running with /etc/init.d/slpd status. - Check exposure: ESXi management and port 427 should never be reachable from the internet. Fix: 1. Upgrade to a supported ESXi release with current patches (this covers CVE-2021-21974 and later critical bugs). 2. Disable SLP if you don't use it (most environments don't), using VMware's documented steps: /etc/init.d/slpd stop, esxcli network firewall ruleset set -r CIMSLP -e 0, and chkconfig slpd off so it stays off after reboot. Newer ESXi releases ship with SLP disabled by default. 3. Put ESXi management interfaces on an isolated management network; block port 427 and management ports at the perimeter. 4. Keep offline or immutable backups of VMs and host configuration. If a host was hit by ESXiArgs, follow CISA's AA23-039A guidance and evaluate CISA's ESXiArgs-Recover script; note a later ransomware variant made that recovery method much less effective. Verify: esxcli system version get shows a current build, /etc/init.d/slpd status reports it's not running, and an external scan shows port 427 closed. Sources: https://www.vmware.com/security/advisories/VMSA-2021-0002.html https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-039a https://nvd.nist.gov/vuln/detail/CVE-2021-21974