ESXi 5

VMSA-2016-0010 bundles two flaws: CVE-2016-5330 is a DLL side-loading bug in the VMware Tools HGFS (Shared Folders) component on Windows guests — an attacker who can drop a DLL on the guest's search path or trick a user into opening a file from a network share gets code execution as the current user. CVE-2016-5331 is a CRLF / HTTP header injection flaw in the vCenter/ESXi web layer that allows HTTP response splitting. Affected: ESXi 5.0, 5.1, 5.5, 6.0, plus the corresponding vCenter and VMware Tools packages. Fixes were shipped via KB2141429 / 2142193 / 2143976 / 2144359 in mid-2016.

Tenable's MEDIUM (CVSSv2 4.4) rating matches reality for the CVEs themselves: neither flaw is a hypervisor escape, neither yields SYSTEM on the host, and CVE-2016-5330 requires the non-default HGFS component plus user interaction. The CVSSv3 7.8 rescore is aspirational. The *real* story is not the bugs — it is that if Nessus still fires plugin 92949 in 2026, you are running a hypervisor that has been end-of-general-support since 2020 (6.0) or earlier, missing five years of critical VMSA advisories including OpenSLP RCEs and ESXiArgs ransomware exposure. Patch this and you close a 2016 finding; the underlying platform is still a strategic liability.

Why this verdict

• Chain terminates below the hypervisor. CVE-2016-5330 executes in the *guest* user context; CVE-2016-5331 is response splitting. Neither reaches the ESXi kernel or vmkernel, so the hypervisor role multiplier does not apply.
• Prerequisite friction is heavy. HGFS Shared Folders is not installed by the default VMware Tools setup, and the CRLF flaw requires reachable management-plane HTTPS — an interface no mature program exposes externally.
• No KEV, no campaigns, EPSS near zero. Ten years post-disclosure with no adversary interest is signal, not noise.
• Role multiplier — hypervisor: The affected component runs on ESXi (canonical high-value role, ≥90% of installs), but the documented chain does *not* succeed at fleet scale here — outcome is user-context RCE in a guest, not domain/fleet compromise. Floor does not lift above MEDIUM for these specific CVEs.
• The finding is a proxy metric. Any host still returning this plugin in 2026 is running an EOL hypervisor missing five years of criticals (OpenSLP, ESXiArgs class). Treat the *finding* seriously even though the *CVEs* are not.

Why not higher?

To justify HIGH, the chain would need to end in VM escape, DA-tier credential theft, or fleet compromise. It does not — it ends in user-context code execution in a guest OS with a non-default component. HIGH would also require credible active exploitation, which is absent (no KEV, near-zero EPSS).

Why not lower?

LOW/IGNORE would be wrong because Metasploit tooling exists, the affected fleet is by definition EOL and unlikely to receive discipline elsewhere, and the compensating controls (HGFS removal, management-plane segmentation) are non-trivial in legacy vSphere environments.

1. Inventory every ESXi 5.x/6.0 host this week and flag them for platform replacement, not just patching — The 2016 patch closes this VMSA but leaves you on an EOL hypervisor. Build an upgrade plan to 7.0 U3 or 8.0 — this is the real remediation. Since verdict is MEDIUM there is no noisgate mitigation SLA, but the EOL condition itself warrants prioritisation independent of this CVE.
2. Uninstall or disable the HGFS Shared Folders component in VMware Tools on all Windows guests — This is the attack surface for CVE-2016-5330. Redeploy VMware Tools with Typical (which omits HGFS) or run VMwareToolboxCmd.exe to disable shared folders. Fleet-wide via GPO or config management within the 365-day remediation window.
3. Segment the vSphere management network off the corporate LAN — Neutralises CVE-2016-5331 (unreachable endpoint = unreachable CRLF) and blunts the far more dangerous EOL-era ESXi bugs. Jump-host access only, MFA at the bastion. Standard hardening — do it inside the 365-day window.
4. Update VMware Tools to 10.0.6+ across all guests as a matter of course — Fixes CVE-2016-5330 at the source. VMware Tools updates are trivial compared to hypervisor patching and can be rolled fleet-wide via config management.

Run on an auditor workstation with PowerCLI installed and a vCenter/ESXi read-only credential. Invoke as .\Check-VMSA-2016-0010.ps1 -Server vcenter.corp.local. Requires network reach to the management endpoint and vSphere.View privilege. Outputs VULNERABLE, PATCHED, or UNKNOWN per host.

#Requires -Modules VMware.PowerCLI
# Check-VMSA-2016-0010.ps1 — audit ESXi hosts for VMSA-2016-0010 patch level
param(
    [Parameter(Mandatory=$true)][string]$Server,
    [PSCredential]$Credential = (Get-Credential -Message 'vCenter/ESXi read-only creds')
)

$ErrorActionPreference = 'Stop'
Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -Confirm:$false | Out-Null

try {
    Connect-VIServer -Server $Server -Credential $Credential | Out-Null
} catch {
    Write-Output 'UNKNOWN: connection failed'
    exit 2
}

# Minimum patched builds addressing VMSA-2016-0010
$minBuild = @{
    '5.0' = 3982828   # ESXi500-201606001
    '5.1' = 3872664   # ESXi510-201605001
    '5.5' = 3872664   # ESXi550-201607001
    '6.0' = 3825889   # ESXi600-201608001
}

$exitCode = 0
Get-VMHost | ForEach-Object {
    $ver   = ($_.Version)
    $build = [int]$_.Build
    $line  = "$($_.Name)  Version=$ver  Build=$build  "

    if ($ver -match '^7\.|^8\.') {
        Write-Output "$line=> PATCHED (post-EOL train, VMSA-2016-0010 superseded)"
    } elseif ($minBuild.ContainsKey($ver)) {
        if ($build -ge $minBuild[$ver]) {
            Write-Output "$line=> PATCHED"
        } else {
            Write-Output "$line=> VULNERABLE (needs build >= $($minBuild[$ver])) — AND host is EOL, plan platform upgrade"
            $exitCode = 1
        }
    } else {
        Write-Output "$line=> UNKNOWN version"
        if ($exitCode -eq 0) { $exitCode = 3 }
    }
}

Disconnect-VIServer -Server $Server -Confirm:$false | Out-Null
exit $exitCode

Sources

1. Tenable Plugin 92949
2. VMSA-2016-0010 (Broadcom / VMware)
3. NVD — CVE-2016-5330
4. NVD — CVE-2016-5331
5. Rapid7 — VMSA-2016-0010 / CVE-2016-5330
6. CVE Details — CVE-2016-5331 (CRLF)
7. InfoSec Matter — plugin 92949 reference
8. Vulners — VMSA-2016-0010 remote check NASL