CVE-2019-5544

What Is OpenSLP in VMware ESXi?

ESXi is VMware's bare-metal hypervisor, the foundation of countless enterprise virtualization environments. OpenSLP is an open-source implementation of the Service Location Protocol, used by ESXi to advertise and discover network services. It listens on UDP/TCP port 427 and, because it is part of the hypervisor's management surface, a memory-corruption bug in it threatens the security of every virtual machine running on that host — a single vulnerable ESXi host can mean the compromise of dozens of guest VMs at once.

Overview

CVE-2019-5544 is a critical heap-based buffer overflow (CWE-787, Out-of-Bounds Write) in the OpenSLP service bundled with VMware ESXi and Horizon Desktop-as-a-Service (DaaS). An attacker with network access to the OpenSLP service (port 427) can send crafted SLP protocol data that corrupts heap memory, potentially achieving remote code execution at the hypervisor level. CVSS score: 9.8.

Technical Details

OpenSLP processes SLP protocol messages received over the network; the vulnerable code fails to properly bound-check certain fields when parsing these messages, allowing an attacker-controlled value to overflow a heap-allocated buffer. Because OpenSLP typically runs with high privileges as part of the ESXi management stack, successful heap corruption can be leveraged into arbitrary code execution on the hypervisor itself — not just a single guest VM — making this a hyperjacking-class vulnerability. No authentication is required; only network reachability to port 427 is needed to attempt exploitation.

Discovery

VMware disclosed and patched this vulnerability through its own security advisory process in December 2019. OpenSLP in ESXi has been a recurring source of memory-safety vulnerabilities across multiple years, reflecting the general risk of exposing legacy service-discovery protocols on management interfaces.

Exploitation Context

CISA's KEV addition confirms this vulnerability has been exploited in the wild, with ransomware association noted for this entry — consistent with the broader pattern of ESXi hosts being high-value ransomware targets, since encrypting datastores or VM disk files at the hypervisor level can knock out dozens of virtual servers in a single attack. Hypervisor-level network services like OpenSLP are especially dangerous attack surfaces because they are sometimes reachable from management networks that aren't as tightly restricted as production traffic.

Remediation

1. Apply VMware's security patch for CVE-2019-5544 to all affected ESXi and Horizon DaaS hosts.
2. Disable the SLP service on ESXi hosts if it is not required — VMware has published guidance on disabling slpd where service discovery via SLP is unnecessary.
3. Restrict network access to port 427 (and other hypervisor management ports) to a dedicated, tightly controlled management network — never expose ESXi management interfaces to general production networks or the internet.
4. Keep ESXi patched on a regular cadence, given the hypervisor's repeated history of OpenSLP-related vulnerabilities across multiple CVEs.
5. Monitor for signs of hypervisor compromise, including unexpected changes to VM configurations, unauthorized snapshot/backup activity, or datastore encryption events consistent with ransomware.