This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] VMware fixes 6 vulnerabilities
VMware fixes 6 vulnerabilities in multiple products [1][2]. The vulnerability CVE-2025-41244 is already being actively exploited, and a PoC can be found at [3]. Products and their fixes: VMware Aria Operations - 8.18.5 [1] VMware Cloud Foundation - 9.0.1.0, 13.0.5.0 [1][2] VMware vSphere Foundation - 9.0.1.0, 13.0.5.0 [1][2] VMware Tools - 13.0.5, 12.5.4 [1] VMware Telco Cloud Platform - 8.18.5 [1] VMware Telco Cloud Infrastructure - 8.18.5 [1] VMware vCenter - 7.0 U3w, 8.0 U3g [2] VMware NSX - 4.1.2.7, 4.2.2.2, 4.2.3.1 [2] VMware NSX-T - 3.2.4.3 [2] The remediation procedure for products within the cloud platforms VMware Cloud Foundation, Telco Cloud Platform and Telco Cloud Infrastructure is available at [4][5][6][7].
Allows an authenticated local attacker with non-administrative privileges to escalate privileges to root through access to a virtual machine (VM) with VMware Tools installed and managed in VMware Aria Operations with SDMP enabled [1].
The vulnerability is present in products:
- VMware Cloud Foundation; >=4.0, <=4.5.2; >=5.0, <=5.2.2; >=9.0.0.0, <9.0.1.0; >=13.0.0.0, <13.0.5.0
- VMware vSphere Foundation; >=9.0.0.0, <9.0.1.0; >=13.0.0.0, <13.0.5.0
- VMware Aria Operations; >=8.0, <8.18.5
- VMware Tools; >=11.0.0, <12.5.4; >=13.0.0, <13.0.5
- VMware Telco Cloud Platform; >=4.0, <6.0
- VMware Telco Cloud Infrastructure; >=2.0, <4.0
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-41244 at cve.org, NVD
- CWE-267: Privilege Defined With Unsafe Actions at cwe.mitre.org
The vulnerability was publicly disclosed 29. 9. 2025.
Allows an authenticated attacker on the local network, operating from a guest VM with non-administrative privileges, to gain access to other guest VMs, provided they know the credentials for the target VMs as well as for the vCenter or ESX interface [1].
The vulnerability is present in products:
- VMware Cloud Foundation (Windows); >=13.0.0.0, <13.0.5.0
- VMware vSphere Foundation (Windows); >=13.0.0.0, <13.0.5.0
- VMware Tools (Windows); >=11.0.0, <12.5.4; >=13.0.0, <13.0.5
CVSS: CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2025-41246 at cve.org, NVD
- CWE-863: Incorrect Authorization at cwe.mitre.org
The vulnerability was publicly disclosed 29. 9. 2025.
Allows an authenticated remote attacker with non-administrative privileges to obtain the credentials of other users in VMware Aria Operations [1].
The vulnerability is present in products:
- VMware Cloud Foundation; >=4.0, <=4.5.2; >=5.0, <=5.2.2;
- VMware Aria Operations; >=8.0, <8.18.5
- VMware Telco Cloud Platform; >=4.0, <=5.1
- VMware Telco Cloud Infrastructure; >=2.0, <3.0
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
More information:
- CVE-2025-41245 at cve.org, NVD
- CWE-1188: Insecure Default Initialization of Resource at cwe.mitre.org
The vulnerability was publicly disclosed 29. 9. 2025.
Allows an authenticated remote attacker with permission to create scheduled tasks to manipulate the e-mails sent as notifications about these tasks in VMware vCenter [2].
The vulnerability is present in products:
- VMware Cloud Foundation; >=4.5.0, <= 4.5.2; >=5.0, <5.2.2; >=9.0.0.0, <9.0.1.0
- VMware vSphere Foundation; >=9.0.0.0, <9.0.1.0
- VMware vCenter; >=8.0, <8.0 U3g; >=7.0, <7.0 U3w;
- VMware Telco Cloud Platform; >=2.0, <6.0
- VMware Telco Cloud Infrastructure; >=2.0, <4.0
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L
More information:
- CVE-2025-41250 at cve.org, NVD
- CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 29. 9. 2025.
Allows an unauthenticated remote attacker to obtain a list of valid usernames in VMware NSX and perform a brute-force attack [2].
The vulnerability is present in products:
- VMware Cloud Foundation; >=9.0.0.0, <9.0.1.0
- VMware vSphere Foundation; >=9.0.0.0, <9.0.1.0
- VMware NSX; >=4.0.0, <4.1.2.7; >=4.2.0, <4.2.2.2
- VMware NSX-T; >=3.0, <3.2.4.3
- VMware Telco Cloud Infrastructure; >=2.0, <=3.0
- VMware Telco Cloud Platform; >=3.0, <=5.1
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-41251 at cve.org, NVD
- CWE-640: Weak Password Recovery Mechanism for Forgotten Password at cwe.mitre.org
The vulnerability was publicly disclosed 29. 9. 2025.
Allows an unauthenticated remote attacker to obtain valid usernames in VMware NSX and thereby attempt unauthorised access [2].
The vulnerability is present in products:
- VMware Cloud Foundation; >=9.0.0.0, <9.0.1.0
- VMware vSphere Foundation; >=9.0.0.0, <9.0.1.0
- VMware NSX; >=4.0.0, <4.1.2.7; >=4.2.0, <4.2.2.2
- VMware NSX-T; >=3.0, <3.2.4.3
- VMware Telco Cloud Infrastructure; >=2.0, <=3.0
- VMware Telco Cloud Platform; >=3.0, <=5.1
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
More information:
- CVE-2025-41252 at cve.org, NVD
- CWE-203: Observable Discrepancy at cwe.mitre.org
The vulnerability was publicly disclosed 29. 9. 2025.
Links
- [1] https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36149
- [2] https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36150
- [3] https://blog.nviso.eu/2025/09/29/you-name-it-vmware-elevates-it-cve-2025-41244/
- [4] https://knowledge.broadcom.com/external/article?legacyId=92148
- [5] https://knowledge.broadcom.com/external/article/411508
- [6] https://knowledge.broadcom.com/external/article?legacyId=88287
- [7] https://knowledge.broadcom.com/external/article/411518
By CESNET, z.s.p.o. Michaela Jarošová on 1. 10. 2025.