CVE-2025-41246

Katalog CVE

CVSS 7.6 · High EPSS 0,28%

Kerentanan Incorrect Authorization. Skor CVSS 3.1 7.6 (High) menurut vmware.com.

Deskripsi (NVD)

VMware Tools for Windows contains an improper authorisation vulnerability due to the way it handles user access controls. A malicious actor with non-administrative privileges on a guest VM, who is already authenticated through vCenter or ESX may exploit this issue to access other guest VMs. Successful exploitation requires knowledge of credentials of the targeted VMs and vCenter or ESX.

Rincian

Terbit di NVD

29 September 2025

Terakhir diubah

9 Oktober 2026

Status NVD

Deferred

CVSS 3.1

7.6 (High), sumber vmware.com
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,28% peluang dieksploitasi; lebih tinggi dari 18,7% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/3614...