This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] VMware fixes 7 vulnerabilities in various products

VMware fixes 7 vulnerabilities in vCenter Server, ESXi, Cloud Foundation (vCenter, ESXi), VMware Telco Cloud Platform (vCenter, ESXi), Telco Cloud Infrastructure (vCenter, ESXi), Workstation and Fusion (MacOS). The fixed versions can be found at [1][2]. The most serious vulnerabilities are listed below.

VMware Cloud Foundation - directory traversal (CVE-2025-41229)
CVSS 8.2 (High)

An unauthenticated remote attacker can carry out a directory traversal attack in VMware Cloud Foundation [1].

The vulnerability is present in product:

  • VMware Cloud Foundation; >=5.0, <5.2.1.2;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

More information:

  • CVE-2025-41229 at cve.org, NVD
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') at cwe.mitre.org

The vulnerability was publicly disclosed 20. 5. 2025.

VMware Cloud Foundation - informaction disclosure (CVE-2025-41230)
CVSS 7.5 (High)

An unauthenticated remote attacker can gain unauthorized access to information in VMware Cloud Foundation [1].

The vulnerability is present in product:

  • VMware Cloud Foundation; >=5.0, <5.2.1.2;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

More information:

The vulnerability was publicly disclosed 20. 5. 2025.

VMware vCenter Server - command execution (CVE-2025-41225)
CVSS 8.8 (High)

An authenticated remote attacker with privileges to modify alarms and run scripts can execute commands in the operating system of the device in VMware vCenter Server [2].

The vulnerability is present in product:

  • VMware vCenter Server; >=7.0, <7.0 U3v; >=8.0, <8.0 U3e;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2025-41225 at cve.org, NVD
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 20. 5. 2025.

VMware ESXi - DoS (CVE-2025-41226)
CVSS 6.8 (Medium)

An authenticated local attacker with "guest" privileges granted within a virtual machine in VMware ESXi can cause a DoS [2].

CVSS: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

More information:

The vulnerability was publicly disclosed 20. 5. 2025.

VMware ESXi, vCenter Server - XSS (CVE-2025-41228)
CVSS 4.3 (Medium)

An unauthenticated remote attacker can carry out a reflected XSS attack in VMware ESXi and vCenter Server [2].

The vulnerability is present in product:

  • VMware vCenter Server; >=7.0, <7.0 U3v; >=8.0, <8.0 U3e;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

More information:

  • CVE-2025-41228 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 20. 5. 2025.

By CESNET, z.s.p.o. Martin Krajči on 22. 5. 2025.

CESNET, z.s.p.o. Logo