7.8

CVE-2025-41244

Warnung
Medienbericht
Exploit

VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)

VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
VMware ≫ Aria Operations Version >= 8.0 < 8.18.5
VMware ≫ Cloud Foundation Version >= 4.0 <= 5.2.2
VMware ≫ Open Vm Tools Version >= 11.2.0 < 12.5.4
VMware ≫ Open Vm Tools Version13.0.0
VMware ≫ Telco Cloud Infrastructure Version >= 2.2 <= 3.0
VMware ≫ Telco Cloud Platform Version >= 4.0 < 5.0.1
VMware ≫ Tools Version >= 12.5.0 < 12.5.4
   Linux ≫ Linux Kernel Version-
   Microsoft ≫ Windows Version-
VMware ≫ Tools Version >= 13.0.0.0 < 13.0.5.0
   Linux ≫ Linux Kernel Version-
   Microsoft ≫ Windows Version-
Debian ≫ Debian Linux Version11.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login

30.10.2025: CISA Known Exploited Vulnerabilities (KEV) Catalog

Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability

Schwachstelle

Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.

Beschreibung

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.59% 0.692
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security@vmware.com 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-267 Privilege Defined With Unsafe Actions

A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity.