VMware ESXi 5

CVE-2015-2342 is a *double-free* in SLPDProcessMessage() inside the OpenSLP daemon that ships enabled on ESXi 5.5 and listens on TCP/UDP 427. An unauthenticated remote attacker who can reach the SLP port sends a crafted Service Location Protocol message and gets code execution in the context of the OpenSLP process on the hypervisor — a position from which VM escape, datastore encryption, and lateral pivot are all trivially reachable. Affected: ESXi 5.5 prior to build 3029944 (patch ESXi550-201509101-SG, October 2015); sibling plugins 86945/86946 cover ESXi 5.0/5.1. Related CVEs in the same VMSA: CVE-2015-1047, CVE-2015-5177.

Vendor severity of CRITICAL is *correct*, and if anything understated for 2026. The OpenSLP-on-ESXi class was later mass-weaponized as CVE-2021-21974 by the ESXiArgs ransomware campaign in Feb 2023, which encrypted thousands of internet-exposed ESXi hosts. Any host that still fires plugin 86947 today is running an end-of-general-support hypervisor (ESXi 5.5 EOGS 2018, EOTG 2020) — so this finding is really a canary for *every* unpatched ESXi CVE from the last decade, not just this one.

Why this verdict

• Role multiplier — hypervisor: Chain succeeds on ESXi mgmt interface; blast radius is fleet-level (every VM on the host, plus datastore-adjacent VMs). 100% of installs of this component ARE the high-value role — the bug lives inside the hypervisor itself. CRITICAL floor engaged.
• Unauthenticated + network-reachable: No credentials, no user interaction, single UDP/TCP packet class. This is the exact profile that ransomware crews automate.
• Class already mass-weaponized: ESXiArgs proved the OpenSLP-on-ESXi attack surface is industrial-grade; the 2015 bug is the same code with an older heap.
• EOL platform amplifier: ESXi 5.5 has no vendor support since 2020. This finding is a proxy indicator for dozens of unpatched criticals on the same host — you cannot triage it in isolation.
• Friction that does exist — SLP-disable and mgmt segmentation: Shops that disabled slpd or wall-off the mgmt VLAN raise the bar, but neither is universal and neither justifies dropping below the hypervisor CRITICAL floor per the hard rule.

Why not higher?

Already at the top of the severity ladder. The only reason the reassessed score is 9.8 rather than 10.0 is that the SLP daemon is disable-able and a subset of hardened shops have done so, which slightly narrows the exploitable population versus a flaw in a mandatory hypervisor service.

Why not lower?

Downgrading a pre-auth RCE in a hypervisor would violate the deployment-role floor. Even if this specific 2015 CVE lacks a widely circulated PoC, (a) the code path was later mass-exploited via CVE-2021-21974 and (b) any host on which the plugin fires is by definition running an unsupported ESXi 5.5 build — the *host*, not just the CVE, is critical debt.

1. Disable the OpenSLP daemon on every ESXi host — Ship the KB76372 procedure: esxcli system slp set --enable false (or /etc/init.d/slpd stop + chkconfig slpd off on 5.5) and confirm esxcli network firewall ruleset set -r CIMSLP -e false. Deploy across the estate within 3 days per the noisgate mitigation SLA for CRITICAL.
2. Block TCP/UDP 427 at the segment boundary of the ESXi mgmt VLAN — Northbound ACL on the ToR/firewall closing 427 in both directions to/from the mgmt VLAN. Belt-and-braces with the daemon disable; if a host is re-imaged or slpd is re-enabled the ACL still holds. Same 3-day mitigation window.
3. Move all ESXi 5.5 workloads onto a supported version — 5.5 → 6.7 → 7.0/8.0 upgrade path; if hardware is incompatible, evacuate VMs to supported hosts. Target completion within 90 days per the noisgate remediation SLA — this is the only real fix, patching a 2015 build leaves you exposed to everything shipped after.
4. Verify vCenter and backup credentials are unique per host tier — If a compromised 5.5 host has cached vCenter admin creds, one RCE becomes fleet takeover. Rotate any credential ever entered on a 5.5 host and enforce tiered vCenter accounts with PAM checkout.
5. Confirm backup immutability for VM data — Veeam hardened repository, S3 Object Lock, or tape airgap — the ESXiArgs ransom pattern is what you are actually defending against here. Should already exist; audit within the same 3-day window.

Run on the ESXi host itself via SSH as root, or from an auditor workstation with SSH key access — e.g. ssh [email protected] 'bash -s' < check_vmsa_2015_0007.sh. Requires read access to vmware -v, esxcli system version get, and esxcli system slp (5.5 build). Exits 2 = VULNERABLE, 0 = PATCHED, 1 = UNKNOWN.

#!/bin/sh
# noisgate: VMSA-2015-0007 / CVE-2015-2342 check for ESXi 5.5
# Target: ESXi shell. Run as root.
set -u

VER=$(vmware -v 2>/dev/null)
BUILD=$(esxcli system version get 2>/dev/null | awk -F': ' '/Build/ {print $2}')
PRODUCT=$(esxcli system version get 2>/dev/null | awk -F': ' '/Version/ {print $2}')

if [ -z "$BUILD" ] || [ -z "$PRODUCT" ]; then
  echo "UNKNOWN: unable to read ESXi version/build"
  exit 1
fi

echo "Detected: $VER (Version $PRODUCT, Build $BUILD)"

# Only ESXi 5.5 is in scope for this plugin; other majors covered by 86945/86946 + later plugins
case "$PRODUCT" in
  5.5.*)
    FIXED_BUILD=3029944
    if [ "$BUILD" -lt "$FIXED_BUILD" ] 2>/dev/null; then
      # Also check SLP daemon status as compensating control indicator
      SLP=$(esxcli network firewall ruleset list 2>/dev/null | awk '/CIMSLP/ {print $2}')
      SLPD=$(/etc/init.d/slpd status 2>/dev/null | head -1)
      echo "VULNERABLE: ESXi 5.5 build $BUILD < $FIXED_BUILD (VMSA-2015-0007 / CVE-2015-2342)"
      echo "  SLP firewall ruleset: ${SLP:-unknown}"
      echo "  slpd status:          ${SLPD:-unknown}"
      echo "  Note: ESXi 5.5 reached end of technical guidance 2020-09-19 — upgrade, do not just patch."
      exit 2
    else
      echo "PATCHED: ESXi 5.5 build $BUILD >= $FIXED_BUILD"
      echo "  WARNING: 5.5 is EOL; upgrade to a supported major regardless."
      exit 0
    fi
    ;;
  *)
    echo "UNKNOWN: host is $PRODUCT, not ESXi 5.5 — use sibling plugin/script for this major"
    exit 1
    ;;
esac

Sources

1. Tenable plugin 86947
2. VMware VMSA-2015-0007 advisory
3. NVD — CVE-2015-2342
4. CVE-2021-21974 PoC walkthrough (same OpenSLP code path)
5. CISA KEV — CVE-2021-21974 (ESXiArgs)
6. VMware Lifecycle Product Matrix (ESXi 5.5 EOL)
7. VMware KB 76372 — Disabling SLP on ESXi
8. Vulners — OpenVAS entry for VMSA-2015-0007