CVE-2019-5544

What it actually does

Heap-based buffer overflow in OpenSLP allows remote attackers to overwrite memory and achieve arbitrary code execution without authentication.

Why it matters to the business

Critical remote takeover of ESXi hosts and Horizon DaaS appliances used in virtualization and VDI environments; actively exploited in ransomware campaigns with a past CISA deadline, creating high operational disruption and data-loss risk across many organizations.

How an attack unfolds

An attacker sends specially crafted Service Location Protocol packets over UDP or TCP port 427 to trigger the heap overwrite in the vulnerable OpenSLP implementation, leading to remote code execution on ESXi or Horizon DaaS systems.

How to fix it

Apply vendor-supplied patches for OpenSLP in ESXi, Horizon DaaS, and Red Hat Enterprise Linux packages; if immediate patching is not possible, disable the SLP service or restrict network access to port 427.

How to confirm the fix worked

Verify OpenSLP version against vendor advisories, run vulnerability scanners targeting SLP, and confirm service is disabled or firewalled where patches cannot be applied.

Typical attack path

1. Scan for exposed OpenSLP services on port 427
2. Send crafted SLP registration or attribute request packets to trigger heap corruption
3. Achieve remote code execution and establish persistence or deploy ransomware payload
4. Lateral movement within the virtualized environment

How to detect it

Review network logs and packet captures for anomalous SLP traffic on port 427, inspect slpd process crashes or memory dumps on ESXi hosts, and correlate with ransomware indicators in affected virtual environments.

• UDP/TCP port 427 with malformed SLP packets
• slpd process segmentation faults
• unexpected remote code execution artifacts in ESXi vmkernel logs

What your security team should do

• Prioritize patching of all ESXi hosts and Horizon DaaS appliances due to KEV ransomware status
• Restrict or block inbound SLP traffic from untrusted networks immediately
• Monitor EPSS trend and threat actor activity for continued exploitation attempts
• Audit downstream Red Hat Enterprise Linux deployments for affected OpenSLP packages