7.8

CVE-2025-41244

Warnung
Medienbericht
Exploit
VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.
Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
VMware ≫ Aria Operations Version >= 8.0 < 8.18.5
VMware ≫ Cloud Foundation Version >= 4.0 <= 5.2.2
VMware ≫ Open Vm Tools Version >= 11.2.0 < 12.5.4
VMware ≫ Open Vm Tools Version13.0.0
VMware ≫ Telco Cloud Infrastructure Version >= 2.2 <= 3.0
VMware ≫ Telco Cloud Platform Version >= 4.0 < 5.0.1
VMware ≫ Tools Version >= 12.5.0 < 12.5.4
   Linux ≫ Linux Kernel Version-
   Microsoft ≫ Windows Version-
VMware ≫ Tools Version >= 13.0.0.0 < 13.0.5.0
   Linux ≫ Linux Kernel Version-
   Microsoft ≫ Windows Version-
Debian ≫ Debian Linux Version11.0

30.10.2025: CISA Known Exploited Vulnerabilities (KEV) Catalog

Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability

Schwachstelle

Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.

Beschreibung

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.94% 0.755
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security@vmware.com 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-267 Privilege Defined With Unsafe Actions

A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity.