VMware ESXi and Horizon DaaS OpenSLP Heap Overwrite Remote Code Execution Vulnerability (CVE-2019-5544)
Executive & SecOps Summary
SECOPS ASSESSMENTOpenSLP service running on VMware ESXi and Horizon DaaS appliances.
Unauthenticated remote attackers can execute arbitrary code or fully compromise the host by sending malicious SLP messages over the network.
Apply official VMware security patches immediately, or disable the SLP service and block port 427 (TCP/UDP) as a temporary workaround.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the official security patches provided by VMware (VMSA-2019-0022). You can update the ESXi host directly via the command line as follows:
# Place the ESXi host into maintenance mode
esxcli system maintenanceMode set --enable true
# Enable firewall rule for HTTP client and apply the security profile update
esxcli network firewall ruleset set -e true -r httpClient
esxcli software profile update -p ESXi-6.7.0-20191204001-standard -d https://hostupdates.vmware.com/software/VUM/PRODUCTION/main/vmw-depot-index.xml
# Reboot the host and disable maintenance mode
reboot
esxcli system maintenanceMode set --enable false2. Temporary Workaround & Hardening Configuration
If patching cannot be performed immediately, disable the OpenSLP service to eliminate the attack vector.
# Stop and disable the SLP service on the ESXi host via SSH
/etc/init.d/slpd stop
chkconfig slpd off
# (Optional) Verify that the SLP service is disabled from starting on boot
chkconfig --list | grep slpd3. Log Audit & IoC Verification Commands
Use the following commands to verify if the SLP service is running and listening on the network ports.
# Check the current status of the SLP daemon
/etc/init.d/slpd status
# Check if port 427 (TCP/UDP) is actively listening
localcli network ip connection list | grep 427Detect Container Escape & Privilege Escalation Across Your Kubernetes Fleet
Continuous eBPF-based runtime threat detection and posture management for AWS, GCP, Azure, Docker, and Kubernetes workloads.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2019-5544) is a critical heap-based buffer overflow (Heap Overwrite) vulnerability in the OpenSLP (Service Location Protocol) implementation used within VMware ESXi and Horizon DaaS appliances. SLP is utilized for service discovery over port 427 (TCP/UDP). The root cause lies in insufficient boundary checks when parsing incoming network packets, allowing an attacker to overwrite adjacent heap memory structures (CWE-787).
2. Exploitation Mechanics & Attack Scenario
An unauthenticated remote attacker can exploit this vulnerability by sending specially crafted SLP request packets to port 427 of a vulnerable ESXi host. This triggers a heap overflow within the OpenSLP daemon's memory space. By overwriting critical memory structures or function pointers, the attacker can hijack the execution flow and execute arbitrary commands with root privileges on the hypervisor without any authentication or user interaction.
3. Infrastructure & Business Impact
With a maximum CVSSv3 base score of 9.8 (Critical) and its inclusion in the CISA KEV catalog, this vulnerability has been actively exploited in the wild, often by ransomware operators. Compromising the ESXi hypervisor grants the attacker full control over all hosted virtual machines (VMs), leading to catastrophic data exfiltration, ransomware deployment, and severe business disruption.
Official Vendor Advisories & References
OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.
Frequently Asked SecOps Questions (CVE-2019-5544)
FAQQ1. How critical is CVE-2019-5544 and is it actively exploited in the wild?
CVE-2019-5544 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 98.1%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2019-5544?
Primary impacted vendors include vmware across esxi, horizon daas. Scope summary: VMware ESXi and Horizon DaaS appliances with the OpenSLP service enabled (refer to VMware VMSA-2019-0022 for specific version details).
Q3. What temporary mitigations or workarounds exist for CVE-2019-5544 before patching?
[Mitigation] Apply official VMware security patches immediately, or disable the SLP service and block port 427 (TCP/UDP) as a temporary workaround. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2019-5544
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (vmware)
View Category →VMware ESX Insufficient Logging Vulnerability (CVE-2026-41709) - Audit Bypass and Admin Activity Concealment
[Affected Scope] VMware ESX hypervisor environments.
Arista VeloCloud Orchestrator (VCO) On-Premises Remote Code Execution and Privilege Bypass (CVE-2026-16812)
[Affected Scope] On-premises deployments of VeloCloud Orchestrator (VCO)
VeloCloud Orchestrator (VCO) Privilege Escalation and Internal Access Vulnerability (CVE-2026-114625)
[Affected Scope] On-premise deployments of VeloCloud Orchestrator (VCO).
VMware vCenter Server Syslog Service Directory Traversal Remote Code Execution Vulnerability (CVE-2026-59310)
[Affected Scope] Systems running VMware vCenter Server with the built-in Syslog server service enabled.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.