CVE-2025-41244

HIGHCISA KEV

7.8

Beschreibung

VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.

CVE Details

CVSS v3.1 Bewertung7.8

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AngriffsvektorLOCAL

KomplexitatLOW

Erforderliche PrivilegienLOW

BenutzerinteraktionNONE

Veroffentlicht9/29/2025

Zuletzt geandert11/6/2025

Quellekev

Honeypot-Sichtungen0

CISA KEV

HerstellerBroadcom

ProduktVMware Aria Operations and VMware Tools

SchwachstellennameBroadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability

KEV Aufnahmedatum2025-10-30

Behebungsfrist2025-11-20

Ransomware-NutzungUnknown

Betroffene Produkte

debian:debian_linuxlinux:linux_kernelmicrosoft:windowsvmware:aria_operationsvmware:cloud_foundationvmware:cloud_foundation_operationsvmware:open_vm_toolsvmware:telco_cloud_infrastructurevmware:telco_cloud_platformvmware:tools

Schwachen (CWE)

CWE-267

Referenzen

http://support.broadcom.com/group/ecx/support-content-view/-/support-content/Security%20Advisories/VMSA-2025-0015--VMware-Aria-Operations-and-VMware-Tools-updates-address-multiple-vulnerabilities--CVE-2025-41244-CVE-2025-41245--CVE-2025-41246-/36149(security@vmware.com)

http://www.openwall.com/lists/oss-security/2025/09/29/10(af854a3a-2127-422b-91ae-364da2661108)

https://lists.debian.org/debian-lts-announce/2025/10/msg00000.html(af854a3a-2127-422b-91ae-364da2661108)

https://blog.nviso.eu/2025/09/29/you-name-it-vmware-elevates-it-cve-2025-41244/(134c704f-9b21-4f2e-91b3-4a467353bcc0)

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36149(134c704f-9b21-4f2e-91b3-4a467353bcc0)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-41244(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.