Skip to content
enodia

VMware ESXi

Calls ServiceContent.about via the vSphere API’s own RetrieveServiceContent SOAP discovery call at /sdk — the same call and endpoint vCenter Server answers, distinguished by the apiType field.

targets:
  - id: esxi-main
    product: esxi
    address: https://esxi-host.example.com

Authentication

Section titled “Authentication”

None — confirmed live against a real production ESXi 8.0.3 host, no credentials at all.

Vendor identity check

Section titled “Vendor identity check”

apiType is compared against "HostAgent" — a real vCenter Server answers the identical call with apiType=VirtualCenter instead (see vCenter Server, which runs this same check in reverse). Pointing product: esxi at a vCenter instance fails loudly rather than getting recorded as a wrong fact.

Recorded fields

Section titled “Recorded fields”
  • version — e.g. 8.0.3
  • extra.build, when present

CVE correlation

Section titled “CVE correlation”

Not matched — almost all of its entries are 7.0 + update_1-style literals the matcher doesn’t read, so the result would be either nothing or everything. See CVE correlation.

Lifecycle resolver

Section titled “Lifecycle resolver”

endoflife:esxi. The calendar writes the latest patch level of VMware’s 8.0 branch in VMware’s own shorthand (8.0 U3k / 8.0 Update 3k); since 2.1 that’s read as 8.0.3, so a fully patched 8.0 Update 3 host shows as current rather than ahead. The trailing patch letter is dropped — the host’s own version string has nothing to compare it against.