The extension parser in slp_v2message.c in OpenSLP 1.2.1, and other versions before SVN revision 1647, as used in Service Location Protocol daemon (SLPD) in VMware ESX 4.0 and 4.1 and ESXi 4.0 and 4.1, allows remote attackers to cause a denial of service (infinite loop) via a packet with a "next extension offset" that references this extension or a previous extension. NOTE: some of these details are obtained from third party information.
Conclusion & alert: CVE-2010-3609 is rated High Exploit Risk (67.4/100): CVSS Medium severity, with high exploitation likelihood (EPSS 35.47%, 97th percentile). Core evidence: 1 public exploit reference(s) are indexed (Exploit-DB). Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
| EDB-ID | Source | Kind | Published | Link |
|---|---|---|---|---|
| 17610 | exploit_db | edb | 2011-08-05 | Exploit-DB ↗ |
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2025-11-18 | 36.98% | 35.47% | -1.51% |
| 2 | 2025-09-16 | 34.59% | 36.98% | +2.38% |
| 3 | 2025-08-11 | — | 34.59% | — |
Full EPSS history (10 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 5.0 | 2.0 | MEDIUM |
|
10.0 | 2.9 | [email protected] |
| vendor | priority | summary | link |
|---|---|---|---|
gentoo
|
normal | CVE-2010-3609: 1 GLSA(s) (201707-05), 1 atom(s) (net-libs/openslp); latest impact normal. | https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2010-3609 |
suse
|
medium | CVE-2010-3609 severity moderate: SUSE including 59 source package names (libslp1-2.0.0-160000.2.2, libslp1-openssl1-1.2.0-172.26.1, …), 86 product×package rows across 35 product lines (SUSE Linux Enterprise Desktop 12, SUSE Linux Enterprise Desktop 12 SP1, … (35 product lines)): Fixed 86. | https://www.suse.com/security/cve/CVE-2010-3609/ |
ubuntu
|
medium | CVE-2010-3609 medium priority: Ubuntu including 2 source packages (openslp, openslp-dfsg), 12 status rows across 6 suites (dapper, hardy, karmic, lucid, maverick, upstream): DNE 5, released 5, needs-triage 2. | https://ubuntu.com/security/CVE-2010-3609 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| openslp | openslp | 1.2.1 | cpe:2.3:a:openslp:openslp:1.2.1:*:*:*:*:*:*:* |
| vmware | esx | 4.0 | cpe:2.3:a:vmware:esx:4.0:*:*:*:*:*:*:* |
| vmware | esx | 4.1 | cpe:2.3:a:vmware:esx:4.1:*:*:*:*:*:*:* |
| vmware | esxi | 4.0 | cpe:2.3:a:vmware:esxi:4.0:*:*:*:*:*:*:* |
| vmware | esxi | 4.1 | cpe:2.3:a:vmware:esxi:4.1:*:*:*:*:*:*:* |