ESXi

Where It Sits

The small stack marks its layer. Beside it, each related technology links to its own page.

About

ESXi is VMware's hypervisor that installs straight onto the hardware. It hosts many virtual machines and is managed over its own web interface and network ports. A flaw in it reaches every virtual machine it runs.

How to Spot It

These are signs that a system runs ESXi, seen from outside without signing in, such as a response header, a cookie, a path or a default port. They help you find where it runs across your own estate. A version shown to the world also tells anyone scanning which flaws might apply, so it is worth hiding.

Path

/ui/ (ESXi host client)

Page source

VMware ESXi

Default port

902 (VMware Authentication Daemon)

If It Has a Flaw

Well-Known Flaws

Each flaw has a CVE id, the unique number a publicly known vulnerability is given so that every advisory names the same flaw. The id links to the advisory, and the card says what the flaw let an attacker do and how far it reached because of where ESXi sits.

• CVE-2021-21974 (opens in a new tab)2021

  OpenSLP Heap Overflow

  A heap overflow in the OpenSLP service on port 427 let attackers run code on ESXi.

  Reach It reached the hypervisor and every virtual machine on it, and was a suspected way in for the ESXiArgs ransomware.

Rivals

Rivals do the same job on the same layer, so a system usually runs one of them in any one place. A flaw in a rival does not reach ESXi.

• Hyper-V
• Cloud VM

Stacks and Code

Its code arrives from the sources listed, and each source's page says how bad code could get in through it.

Its Code Comes From

Vendor Updates

Sources

• Broadcom TechDocs: VMware vSphere (opens in a new tab)