certfr_avis - certfr-2025-avi-0832

CERTFR-2025-AVI-0832

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits VMware. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
VMware	Cloud Foundation	Cloud Foundation versions 4.5.x avec vCenter versions 7.x antérieures à 7.0 U3w
VMware	Telco Cloud Platform	Telco Cloud Platform versions 5.x, 4.x, 3.x et 2.x sans les recommandations des articles KB411508 et KB411518
VMware	NSX	NSX versions 4.2.2.x antérieures à 4.2.2.2
VMware	Telco Cloud Infrastructure	Telco Cloud Infrastructure versions 3.x et 2.x sans les recommandations des articles KB411508 et KB411518
VMware	Cloud Foundation	Cloud Foundation versions 5.x antérieures à 5.2.2
VMware	NSX	NSX versions 4.2.3.x antérieures à 4.2.3.1
VMware	NSX	NSX-T versions 3.x antérieures à 3.2.4.3
VMware	Cloud Foundation	Cloud Foundation versions 9.x antérieures à 9.0.1.0
VMware	vCenter Server	vCenter versions 7.x antérieures à 7.0 U3w
VMware	vSphere Foundation	vSphere Foundation versions 13.x antérieures à 13.0.5.0
VMware	vCenter Server	vCenter versions 8.x antérieures à 8.0 U3g
VMware	Telco Cloud Platform	Telco Cloud Platform versions 5.x et 4.x avec Aria Operations versions 8.x antérieures à 8.18.5
VMware	vSphere Foundation	vSphere Foundation versions 9.x antérieures à 9.0.1.0
VMware	Cloud Foundation	Cloud Foundation versions 13.x antérieures à 13.0.5.0
VMware	VMware Tools	VMware Tools versions 13.x antérieures à 13.0.5
VMware	Cloud Foundation	Cloud Foundation versions 5.x et 4.x sans les recommandations des articles KB92148 et KB88287
VMware	Telco Cloud Infrastructure	Telco Cloud Infrastructure versions 3.x et 2.x avec Aria Operations versions 8.x antérieures à 8.18.5
VMware	NSX	NSX versions 4.0.x et 4.1.x antérieures à 4.1.2.7
VMware	Aria Operations	Aria Operations versions 8.x antérieures à 8.18.5
VMware	VMware Tools	VMware Tools versions 11.x et 12.x antérieures à 12.5.4

References

Title

Publication Time

Tags

Bulletin de sécurité VMware 36149	2025-09-29	vendor-advisory
Bulletin de sécurité VMware 36150	2025-09-29	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Cloud Foundation versions 4.5.x avec vCenter versions 7.x ant\u00e9rieures \u00e0 7.0 U3w",
      "product": {
        "name": "Cloud Foundation",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Telco Cloud Platform versions 5.x, 4.x, 3.x et 2.x sans les recommandations des articles KB411508 et KB411518",
      "product": {
        "name": "Telco Cloud Platform",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "NSX versions 4.2.2.x ant\u00e9rieures \u00e0 4.2.2.2",
      "product": {
        "name": "NSX",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Telco Cloud Infrastructure versions 3.x et 2.x sans les recommandations des articles KB411508 et KB411518",
      "product": {
        "name": "Telco Cloud Infrastructure",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Cloud Foundation versions 5.x ant\u00e9rieures \u00e0 5.2.2",
      "product": {
        "name": "Cloud Foundation",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "NSX versions 4.2.3.x ant\u00e9rieures \u00e0 4.2.3.1",
      "product": {
        "name": "NSX",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "NSX-T versions 3.x ant\u00e9rieures \u00e0 3.2.4.3",
      "product": {
        "name": "NSX",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Cloud Foundation versions 9.x ant\u00e9rieures \u00e0 9.0.1.0",
      "product": {
        "name": "Cloud Foundation",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "vCenter versions 7.x ant\u00e9rieures \u00e0 7.0 U3w",
      "product": {
        "name": "vCenter Server",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "vSphere Foundation versions 13.x ant\u00e9rieures \u00e0 13.0.5.0",
      "product": {
        "name": "vSphere Foundation",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "vCenter versions 8.x ant\u00e9rieures \u00e0 8.0 U3g",
      "product": {
        "name": "vCenter Server",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Telco Cloud Platform versions 5.x et 4.x avec Aria Operations versions 8.x ant\u00e9rieures \u00e0 8.18.5",
      "product": {
        "name": "Telco Cloud Platform",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "vSphere Foundation versions 9.x ant\u00e9rieures \u00e0 9.0.1.0",
      "product": {
        "name": "vSphere Foundation",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Cloud Foundation versions 13.x ant\u00e9rieures \u00e0 13.0.5.0",
      "product": {
        "name": "Cloud Foundation",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware Tools versions 13.x ant\u00e9rieures \u00e0 13.0.5",
      "product": {
        "name": "VMware Tools",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Cloud Foundation versions 5.x et 4.x sans les recommandations des articles KB92148 et KB88287",
      "product": {
        "name": "Cloud Foundation",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Telco Cloud Infrastructure versions 3.x et 2.x avec Aria Operations versions 8.x ant\u00e9rieures \u00e0 8.18.5",
      "product": {
        "name": "Telco Cloud Infrastructure",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "NSX versions 4.0.x et 4.1.x ant\u00e9rieures \u00e0 4.1.2.7",
      "product": {
        "name": "NSX",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Aria Operations versions 8.x ant\u00e9rieures \u00e0 8.18.5",
      "product": {
        "name": "Aria Operations",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware Tools versions 11.x et 12.x ant\u00e9rieures \u00e0 12.5.4",
      "product": {
        "name": "VMware Tools",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-41245",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-41245"
    },
    {
      "name": "CVE-2025-41252",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-41252"
    },
    {
      "name": "CVE-2025-41251",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-41251"
    },
    {
      "name": "CVE-2025-41246",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-41246"
    },
    {
      "name": "CVE-2025-41244",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-41244"
    },
    {
      "name": "CVE-2025-41250",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-41250"
    }
  ],
  "initial_release_date": "2025-09-30T00:00:00",
  "last_revision_date": "2025-09-30T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0832",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-09-30T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits VMware. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits VMware",
  "vendor_advisories": [
    {
      "published_at": "2025-09-29",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 36149",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36149"
    },
    {
      "published_at": "2025-09-29",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 36150",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36150"
    }
  ]
}

CVE-2025-41252 (GCVE-0-2025-41252)

Vulnerability from cvelistv5

Published

2025-09-29 19:02

Modified

2025-09-29 19:14

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-203 - Observable Discrepancy

Summary

Description: VMware NSX contains a username enumeration vulnerability. An unauthenticated malicious actor may exploit this to enumerate valid usernames, potentially leading to unauthorized access attempts. Impact: Username enumeration → facilitates unauthorized access. Attack Vector: Remote, unauthenticated. Severity: Important. CVSSv3: 7.5 (High). Acknowledgments: Reported by the National Security Agency. Affected Products: * VMware NSX 9.x.x.x, 4.2.x, 4.1.x, 4.0.x * NSX-T 3.x * VMware Cloud Foundation (with NSX) 5.x, 4.5.x Fixed Versions: * NSX 9.0.1.0; 4.2.2.2/4.2.3.1 http://4.2.2.2/4.2.3.1 ; 4.1.2.7; NSX-T 3.2.4.3; CCF async patch (KB88287). Workarounds: None.

References

URL

Tags

https://https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36150

Impacted products

	Vendor	Product	Version
	VMware	NSX	Version: VMware NSX 9.x.x.x, 4.2.x, 4.1.x, 4.0.x < Version: VMware NSX-T 3.x < Version: VMware Cloud Foundation (with NSX) 5.x, 4.5.x

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-41252",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-29T19:14:25.259914Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-29T19:14:38.914Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "NSX",
          "vendor": "VMware",
          "versions": [
            {
              "status": "affected",
              "version": "VMware NSX 9.x.x.x, 4.2.x, 4.1.x, 4.0.x",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "VMware NSX-T 3.x",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "VMware Cloud Foundation (with NSX) 5.x, 4.5.x"
            },
            {
              "status": "unaffected",
              "version": "VMware NSX 9.0.1.0; 4.2.2.2/4.2.3.1; 4.1.2.7; NSX-T 3.2.4.3; CCF async patch (KB88287)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cb\u003e\u003c/b\u003e\u003c/p\u003e\u003cp\u003eDescription: VMware NSX contains a username enumeration vulnerability. An unauthenticated malicious actor may exploit this to enumerate valid usernames, potentially leading to unauthorized access attempts.\u003c/p\u003e\n\u003cp\u003eImpact: Username enumeration \u2192 facilitates unauthorized access.\u003c/p\u003e\n\u003cp\u003eAttack Vector: Remote, unauthenticated.\u003c/p\u003e\n\u003cp\u003eSeverity: Important.\u003c/p\u003e\n\u003cp\u003eCVSSv3: 7.5 (High).\u003c/p\u003e\n\u003cp\u003eAcknowledgments: Reported by the National Security Agency.\u003c/p\u003e\n\u003cp\u003eAffected Products:\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003eVMware NSX 9.x.x.x, 4.2.x, 4.1.x, 4.0.x\u003cbr\u003e\u003c/li\u003e\u003cli\u003eNSX-T 3.x\u003cbr\u003e\u003c/li\u003e\u003cli\u003eVMware Cloud Foundation (with NSX) 5.x, 4.5.x\u003cbr\u003e\u003c/li\u003e\u003c/ul\u003e\u003cp\u003e\u003c/p\u003e\n\n\n\u003cp\u003e\u003cbr\u003e\u003c/p\u003e\n\u003cp\u003eFixed Versions:\u0026nbsp;\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003eNSX 9.0.1.0; \u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://4.2.2.2/4.2.3.1\"\u003e4.2.2.2/4.2.3.1\u003c/a\u003e; 4.1.2.7; NSX-T 3.2.4.3; CCF async patch (KB88287).\u003cbr\u003e\u003c/li\u003e\u003c/ul\u003e\u003cp\u003e\u003c/p\u003e\n\u003cp\u003eWorkarounds: None.\u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "Description: VMware NSX contains a username enumeration vulnerability. An unauthenticated malicious actor may exploit this to enumerate valid usernames, potentially leading to unauthorized access attempts.\n\n\nImpact: Username enumeration \u2192 facilitates unauthorized access.\n\n\nAttack Vector: Remote, unauthenticated.\n\n\nSeverity: Important.\n\n\nCVSSv3: 7.5 (High).\n\n\nAcknowledgments: Reported by the National Security Agency.\n\n\nAffected Products:\n\n\n\n  *  VMware NSX 9.x.x.x, 4.2.x, 4.1.x, 4.0.x\n\n  *  NSX-T 3.x\n\n  *  VMware Cloud Foundation (with NSX) 5.x, 4.5.x\n\n\n\n\n\n\n\n\n\n\n\n\nFixed Versions:\u00a0\n\n\n\n  *  NSX 9.0.1.0;  4.2.2.2/4.2.3.1 http://4.2.2.2/4.2.3.1 ; 4.1.2.7; NSX-T 3.2.4.3; CCF async patch (KB88287).\n\n\n\n\n\n\nWorkarounds: None."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-203",
              "description": "CWE-203 Observable Discrepancy",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-29T19:02:07.283Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36150"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Username enumeration vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2025-41252",
    "datePublished": "2025-09-29T19:02:07.283Z",
    "dateReserved": "2025-04-16T09:30:25.625Z",
    "dateUpdated": "2025-09-29T19:14:38.914Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-41246 (GCVE-0-2025-41246)

Vulnerability from cvelistv5

Published

2025-09-29 15:57

Modified

2025-09-30 03:55

Severity ?

7.6 (High) - CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-863 - Incorrect Authorization

Summary

VMware Tools for Windows contains an improper authorisation vulnerability due to the way it handles user access controls. A malicious actor with non-administrative privileges on a guest VM, who is already authenticated through vCenter or ESX may exploit this issue to access other guest VMs. Successful exploitation requires knowledge of credentials of the targeted VMs and vCenter or ESX.

References

URL

Tags

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36149

Impacted products

	Vendor	Product	Version
	VMware	Tools	Version: 13.x.x.x < 13.0.5.0 Version: 12.x.x < 12.5.4 Version: 11.x.x

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-41246",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-29T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-30T03:55:11.488Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Tools",
          "vendor": "VMware",
          "versions": [
            {
              "lessThan": "13.0.5.0",
              "status": "affected",
              "version": "13.x.x.x",
              "versionType": "custom"
            },
            {
              "lessThan": "12.5.4",
              "status": "affected",
              "version": "12.x.x",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "11.x.x"
            }
          ]
        }
      ],
      "datePublic": "2025-09-29T04:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eVMware Tools for Windows contains an improper \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eauthorisation\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;vulnerability due to the way it handles user access controls.\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA malicious actor with non-administrative privileges on a guest VM, who is already authenticated through vCenter or ESX may exploit this issue to access other guest VMs. Successful exploitation requires knowledge of credentials of the targeted VMs and vCenter or ESX.\u003c/span\u003e\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "VMware Tools for Windows contains an improper authorisation\u00a0vulnerability due to the way it handles user access controls.\u00a0A malicious actor with non-administrative privileges on a guest VM, who is already authenticated through vCenter or ESX may exploit this issue to access other guest VMs. Successful exploitation requires knowledge of credentials of the targeted VMs and vCenter or ESX."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-29T15:57:58.438Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36149"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Improper authorisation vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2025-41246",
    "datePublished": "2025-09-29T15:57:58.438Z",
    "dateReserved": "2025-04-16T09:30:25.625Z",
    "dateUpdated": "2025-09-30T03:55:11.488Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-41244 (GCVE-0-2025-41244)

Vulnerability from cvelistv5

Published

2025-09-29 16:09

Modified

2025-10-07 16:07

Severity ?

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-267

Summary

VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.

References

URL

Tags

http://support.broadcom.com/group/ecx/support-content-view/-/support-content/Security%20Advisories/VMSA-2025-0015--VMware-Aria-Operations-and-VMware-Tools-updates-address-multiple-vulnerabilities--CVE-2025-41244-CVE-2025-41245--CVE-2025-41246-/36149

Impacted products

Vendor

Product

Version

VMware

VCF operations

Version: 9.0.x

VMware	VMware tools	Version: 13.x.x.x Version: 12.5.x
VMware	VMware Aria Operations	Version: 8.18.x
VMware	VMware Cloud Foundation	Version: 5.x Version: 4.x
VMware	VMware Telco Cloud Platform	Version: 5.x Version: 4.x
VMware	VMware Telco Cloud Infrastructure	Version: 3.x Version: 2.x

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-41244",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T03:55:53.240091Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-07T16:07:30.319Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit",
              "technical-description"
            ],
            "url": "https://blog.nviso.eu/2025/09/29/you-name-it-vmware-elevates-it-cve-2025-41244/"
          },
          {
            "tags": [
              "vendor-advisory"
            ],
            "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36149"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "VCF operations",
          "vendor": "VMware",
          "versions": [
            {
              "lessThan": "9.0.1.0",
              "status": "affected",
              "version": "9.0.x",
              "versionType": "commercial"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "VMware tools",
          "vendor": "VMware",
          "versions": [
            {
              "lessThan": "13.0.5.0",
              "status": "affected",
              "version": "13.x.x.x",
              "versionType": "commercial"
            },
            {
              "lessThan": "12.5.4",
              "status": "affected",
              "version": "12.5.x",
              "versionType": "commercial"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "VMware Aria Operations",
          "vendor": "VMware",
          "versions": [
            {
              "lessThan": "8.18.5",
              "status": "affected",
              "version": "8.18.x",
              "versionType": "commercial"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "VMware Cloud Foundation",
          "vendor": "VMware",
          "versions": [
            {
              "lessThan": "8.18.5",
              "status": "affected",
              "version": "5.x",
              "versionType": "commercial"
            },
            {
              "lessThan": "8.18.5",
              "status": "affected",
              "version": "4.x",
              "versionType": "commercial"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "VMware Telco Cloud Platform",
          "vendor": "VMware",
          "versions": [
            {
              "lessThan": "8.18.5",
              "status": "affected",
              "version": "5.x",
              "versionType": "commercial"
            },
            {
              "lessThan": "8.18.5",
              "status": "affected",
              "version": "4.x",
              "versionType": "commercial"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "VMware Telco Cloud Infrastructure",
          "vendor": "VMware",
          "versions": [
            {
              "lessThan": "8.18.5",
              "status": "affected",
              "version": "3.x",
              "versionType": "commercial"
            },
            {
              "lessThan": "8.18.5",
              "status": "affected",
              "version": "2.x",
              "versionType": "commercial"
            }
          ]
        }
      ],
      "datePublic": "2025-09-29T16:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eVMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability.\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA malicious local actor with non-administrative privileges having access to a VM with \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eVMware Tools\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.\u003c/span\u003e\u003c/span\u003e\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability.\u00a0A malicious local actor with non-administrative privileges having access to a VM with VMware Tools\u00a0installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-267",
              "description": "CWE-267",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-29T16:16:24.967Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "http://support.broadcom.com/group/ecx/support-content-view/-/support-content/Security%20Advisories/VMSA-2025-0015--VMware-Aria-Operations-and-VMware-Tools-updates-address-multiple-vulnerabilities--CVE-2025-41244-CVE-2025-41245--CVE-2025-41246-/36149"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2025-41244",
    "datePublished": "2025-09-29T16:09:51.871Z",
    "dateReserved": "2025-04-16T09:30:17.799Z",
    "dateUpdated": "2025-10-07T16:07:30.319Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-41250 (GCVE-0-2025-41250)

Vulnerability from cvelistv5

Published

2025-09-29 17:44

Modified

2025-09-30 03:55

Severity ?

8.5 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L

CWE

CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Summary

VMware vCenter contains an SMTP header injection vulnerability. A malicious actor with non-administrative privileges on vCenter who has permission to create scheduled tasks may be able to manipulate the notification emails sent for scheduled tasks.

References

URL

Tags

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36150

Impacted products

Vendor

Product

Version

VMware

vCenter

Version: 8.0 < 8.0 U3g
Version: 7.0 < 7.0 U3w

VMware	Cloud Foundation	Version: 9.x.x.x < 9.0.1.0 Version: 5.x < 5.2.2 Version: 4.5.x
VMware	Telco Cloud Platform	Version: 5.x, 4.x, 3.x, 2.x
VMware	Telco Cloud Infrastructure	Version: 3.x, 2.x
VMware	vSphere Foundation	Version: 9.x.x.x < 9.0.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-41250",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-29T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-30T03:55:12.416Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "vCenter",
          "vendor": "VMware",
          "versions": [
            {
              "lessThan": "8.0 U3g",
              "status": "affected",
              "version": "8.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0 U3w",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Cloud Foundation",
          "vendor": "VMware",
          "versions": [
            {
              "lessThan": "9.0.1.0",
              "status": "affected",
              "version": "9.x.x.x",
              "versionType": "custom"
            },
            {
              "lessThan": "5.2.2",
              "status": "affected",
              "version": "5.x",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "4.5.x"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Telco Cloud Platform",
          "vendor": "VMware",
          "versions": [
            {
              "status": "affected",
              "version": "5.x, 4.x, 3.x, 2.x"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Telco Cloud Infrastructure",
          "vendor": "VMware",
          "versions": [
            {
              "status": "affected",
              "version": "3.x, 2.x"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "vSphere Foundation",
          "vendor": "VMware",
          "versions": [
            {
              "lessThan": "9.0.1.0",
              "status": "affected",
              "version": "9.x.x.x",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2025-09-29T02:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eVMware vCenter contains an SMTP header injection vulnerability.\u0026nbsp;\u003c/span\u003eA malicious actor with non-administrative privileges on vCenter who has permission to create scheduled tasks may be able to manipulate the notification emails sent for scheduled tasks.\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u003cbr\u003e\u003cbr\u003e\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "VMware vCenter contains an SMTP header injection vulnerability.\u00a0A malicious actor with non-administrative privileges on vCenter who has permission to create scheduled tasks may be able to manipulate the notification emails sent for scheduled tasks."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-29T17:54:27.048Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36150"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Header injection vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2025-41250",
    "datePublished": "2025-09-29T17:44:27.967Z",
    "dateReserved": "2025-04-16T09:30:25.625Z",
    "dateUpdated": "2025-09-30T03:55:12.416Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-41245 (GCVE-0-2025-41245)

Vulnerability from cvelistv5

Published

2025-09-29 16:19

Modified

2025-09-30 15:42

Severity ?

4.9 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-1188

Summary

VMware Aria Operations contains an information disclosure vulnerability. A malicious actor with non-administrative privileges in Aria Operations may exploit this vulnerability to disclose credentials of other users of Aria Operations.

References

URL

Tags

Impacted products

Vendor

Product

Version

VMware

VMware Aria Operations

Version: 8.18.x

VMware	VMware Cloud Foundation	Version: 5.x Version: 4.x
VMware	VMware Telco Cloud Platform	Version: 5.x Version: 4.x
VMware	VMware Telco Cloud Infrastructure	Version: 3.x Version: 2.x

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-41245",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-30T15:42:25.242190Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-30T15:42:32.121Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "VMware Aria Operations",
          "vendor": "VMware",
          "versions": [
            {
              "lessThan": "8.18.5",
              "status": "affected",
              "version": "8.18.x",
              "versionType": "commercial"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "VMware Cloud Foundation",
          "vendor": "VMware",
          "versions": [
            {
              "lessThan": "8.18.5",
              "status": "affected",
              "version": "5.x",
              "versionType": "commercial"
            },
            {
              "lessThan": "8.18.5",
              "status": "affected",
              "version": "4.x",
              "versionType": "commercial"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "VMware Telco Cloud Platform",
          "vendor": "VMware",
          "versions": [
            {
              "lessThan": "8.18.5",
              "status": "affected",
              "version": "5.x",
              "versionType": "commercial"
            },
            {
              "lessThan": "8.18.5",
              "status": "affected",
              "version": "4.x",
              "versionType": "commercial"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "VMware Telco Cloud Infrastructure",
          "vendor": "VMware",
          "versions": [
            {
              "lessThan": "8.18.5",
              "status": "affected",
              "version": "3.x",
              "versionType": "commercial"
            },
            {
              "lessThan": "8.18.5",
              "status": "affected",
              "version": "2.x",
              "versionType": "commercial"
            }
          ]
        }
      ],
      "datePublic": "2025-09-29T16:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eVMware Aria Operations contains an information disclosure vulnerability.\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA malicious actor with non-administrative privileges in Aria Operations may exploit this vulnerability to disclose credentials of other users of Aria Operations.\u003c/span\u003e\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "VMware Aria Operations contains an information disclosure vulnerability.\u00a0A malicious actor with non-administrative privileges in Aria Operations may exploit this vulnerability to disclose credentials of other users of Aria Operations."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1188",
              "description": "CWE-1188",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-29T16:19:15.836Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "http://support.broadcom.com/group/ecx/support-content-view/-/support-content/Security%20Advisories/VMSA-2025-0015--VMware-Aria-Operations-and-VMware-Tools-updates-address-multiple-vulnerabilities--CVE-2025-41244-CVE-2025-41245--CVE-2025-41246-/36149"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2025-41245",
    "datePublished": "2025-09-29T16:19:15.836Z",
    "dateReserved": "2025-04-16T09:30:25.625Z",
    "dateUpdated": "2025-09-30T15:42:32.121Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-41251 (GCVE-0-2025-41251)

Vulnerability from cvelistv5

Published

2025-09-29 18:45

Modified

2025-09-30 03:55

Severity ?

8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-640 - Weak Password Recovery Mechanism for Forgotten Password

Summary

VMware NSX contains a weak password recovery mechanism vulnerability. An unauthenticated malicious actor may exploit this to enumerate valid usernames, potentially enabling brute-force attacks. Impact: Username enumeration → credential brute force risk. Attack Vector: Remote, unauthenticated. Severity: Important. CVSSv3: 8.1 (High). Acknowledgments: Reported by the National Security Agency. Affected Products:VMware NSX 9.x.x.x, 4.2.x, 4.1.x, 4.0.x NSX-T 3.x VMware Cloud Foundation (with NSX) 5.x, 4.5.x Fixed Versions: NSX 9.0.1.0; 4.2.2.2/4.2.3.1 http://4.2.2.2/4.2.3.1 ; 4.1.2.7; NSX-T 3.2.4.3; CCF async patch (KB88287). Workarounds: None.

References

URL

Tags

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36150

Impacted products

	Vendor	Product	Version
	vmware	NSX	Version: VMware NSX - 9.x.x.x, 4.2.x, 4.1.x, 4.0.x < Version: VMware NSX-T - 3.x < Version: VMware Cloud Foundation (with NSX) - 5.x, 4.5.x < Patch: VMware NSX 9.0.1.0; 4.2.2.2/4.2.3.1; 4.1.2.7; NSX-T 3.2.4.3; CCF async patch (KB88287)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-41251",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-29T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-30T03:55:13.262Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "NSX",
          "vendor": "vmware",
          "versions": [
            {
              "status": "affected",
              "version": "VMware NSX - 9.x.x.x, 4.2.x, 4.1.x, 4.0.x",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "VMware NSX-T - 3.x",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "VMware Cloud Foundation (with NSX) - 5.x, 4.5.x",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "VMware NSX 9.0.1.0; 4.2.2.2/4.2.3.1; 4.1.2.7; NSX-T 3.2.4.3; CCF async patch (KB88287)",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2025-09-29T18:26:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "VMware NSX contains a weak password recovery mechanism vulnerability. An unauthenticated malicious actor may exploit this to enumerate valid usernames, potentially enabling brute-force attacks.\u003cbr\u003e\u003cb\u003e\u003cbr\u003eImpact:\u003c/b\u003e\u0026nbsp;Username enumeration \u2192 credential brute force risk.\u003cbr\u003e\u003cb\u003eAttack Vector:\u003c/b\u003e\u0026nbsp;Remote, unauthenticated.\u003cbr\u003e\u003cb\u003eSeverity:\u003c/b\u003e\u0026nbsp;Important.\u003cbr\u003e\u003cb\u003eCVSSv3:\u003c/b\u003e\u0026nbsp;8.1 (High).\u003cbr\u003e\u003cb\u003e\u003cbr\u003eAcknowledgments:\u003c/b\u003e\u0026nbsp;Reported by the National Security Agency.\u003cbr\u003e\u003cbr\u003e\u003cb\u003eAffected Products:\u003c/b\u003e\u003cp\u003eVMware NSX 9.x.x.x, 4.2.x, 4.1.x, 4.0.x\u003c/p\u003eNSX-T 3.x\u003cbr\u003eVMware Cloud Foundation (with NSX) 5.x, 4.5.x\u003cbr\u003e\u003cbr\u003e\u003cb\u003eFixed Versions:\u003c/b\u003e NSX 9.0.1.0; \u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://4.2.2.2/4.2.3.1\"\u003e4.2.2.2/4.2.3.1\u003c/a\u003e; 4.1.2.7; NSX-T 3.2.4.3; CCF async patch (KB88287).\u003cbr\u003e\u003cb\u003eWorkarounds:\u003c/b\u003e None.\u003cbr\u003e\u003cul\u003e\n\u003c/ul\u003e\n\u003cbr\u003e\u003cbr\u003e\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "VMware NSX contains a weak password recovery mechanism vulnerability. An unauthenticated malicious actor may exploit this to enumerate valid usernames, potentially enabling brute-force attacks.\n\nImpact:\u00a0Username enumeration \u2192 credential brute force risk.\nAttack Vector:\u00a0Remote, unauthenticated.\nSeverity:\u00a0Important.\nCVSSv3:\u00a08.1 (High).\n\nAcknowledgments:\u00a0Reported by the National Security Agency.\n\nAffected Products:VMware NSX 9.x.x.x, 4.2.x, 4.1.x, 4.0.x\n\nNSX-T 3.x\nVMware Cloud Foundation (with NSX) 5.x, 4.5.x\n\nFixed Versions: NSX 9.0.1.0;  4.2.2.2/4.2.3.1 http://4.2.2.2/4.2.3.1 ; 4.1.2.7; NSX-T 3.2.4.3; CCF async patch (KB88287).\nWorkarounds: None."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-50",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-50 Password Recovery Exploitation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-640",
              "description": "CWE-640 Weak Password Recovery Mechanism for Forgotten Password",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-29T18:45:16.614Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36150"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Weak password recovery vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2025-41251",
    "datePublished": "2025-09-29T18:45:16.614Z",
    "dateReserved": "2025-04-16T09:30:25.625Z",
    "dateUpdated": "2025-09-30T03:55:13.262Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CERTFR-2025-AVI-0832

Vulnerability from certfr_avis

Solutions

CVE-2025-41252 (GCVE-0-2025-41252)

Vulnerability from cvelistv5

CVE-2025-41246 (GCVE-0-2025-41246)

Vulnerability from cvelistv5

CVE-2025-41244 (GCVE-0-2025-41244)

Vulnerability from cvelistv5

CVE-2025-41250 (GCVE-0-2025-41250)

Vulnerability from cvelistv5

CVE-2025-41245 (GCVE-0-2025-41245)

Vulnerability from cvelistv5

CVE-2025-41251 (GCVE-0-2025-41251)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature