CVE-2025-41244
Full vulnerability record from the local CVENow database.
Description
VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.
Severity
HIGH
CVSS score
7.8
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2025-09-29 17:15:30.843000
Last modified
2026-10-18 21:10:00.120000
View original CVE JSON
{
"id": "CVE-2025-41244",
"sourceIdentifier": "[email protected]",
"published": "2025-09-29T17:15:30.843",
"lastModified": "2026-10-18T21:10:00.120",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM."
},
{
"lang": "es",
"value": "VMware Aria Operations y VMware Tools contienen una vulnerabilidad de escalada de privilegios local. Un actor local malicioso con privilegios no administrativos que tenga acceso a una VM con VMware Tools instalado y gestionada por Aria Operations con SDMP habilitado puede explotar esta vulnerabilidad para escalar privilegios a root en la misma VM."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "VMware",
"product": "VCF operations",
"defaultStatus": "unaffected",
"versions": [
{
"version": "9.0.x",
"lessThan": "9.0.1.0",
"versionType": "commercial",
"status": "affected"
}
]
},
{
"vendor": "VMware",
"product": "VMware tools",
"defaultStatus": "unaffected",
"versions": [
{
"version": "13.x.x.x",
"lessThan": "13.0.5.0",
"versionType": "commercial",
"status": "affected"
},
{
"version": "12.5.x",
"lessThan": "12.5.4",
"versionType": "commercial",
"status": "affected"
}
]
},
{
"vendor": "VMware",
"product": "VMware Aria Operations",
"defaultStatus": "unaffected",
"versions": [
{
"version": "8.18.x",
"lessThan": "8.18.5",
"versionType": "commercial",
"status": "affected"
}
]
},
{
"vendor": "VMware",
"product": "VMware Cloud Foundation",
"defaultStatus": "unaffected",
"versions": [
{
"version": "5.x",
"lessThan": "8.18.5",
"versionType": "commercial",
"status": "affected"
},
{
"version": "4.x",
"lessThan": "8.18.5",
"versionType": "commercial",
"status": "affected"
}
]
},
{
"vendor": "VMware",
"product": "VMware Telco Cloud Platform",
"defaultStatus": "unaffected",
"versions": [
{
"version": "5.x",
"lessThan": "8.18.5",
"versionType": "commercial",
"status": "affected"
},
{
"version": "4.x",
"lessThan": "8.18.5",
"versionType": "commercial",
"status": "affected"
}
]
},
{
"vendor": "VMware",
"product": "VMware Telco Cloud Infrastructure",
"defaultStatus": "unaffected",
"versions": [
{
"version": "3.x",
"lessThan": "8.18.5",
"versionType": "commercial",
"status": "affected"
},
{
"version": "2.x",
"lessThan": "8.18.5",
"versionType": "commercial",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-10-30T03:56:00.543163Z",
"id": "CVE-2025-41244",
"options": [
{
"exploitation": "active"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"cisaExploitAdd": "2025-10-30",
"cisaActionDue": "2025-11-20",
"cisaRequiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
"cisaVulnerabilityName": "Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability",
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-267"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:vmware:aria_operations:*:*:*:*:*:*:*:*",
"versionStartIncluding": "8.0",
"versionEndExcluding": "8.18.5",
"matchCriteriaId": "B78BDDD1-DE10-4839-9754-3A0D00F47986"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.0",
"versionEndIncluding": "5.2.2",
"matchCriteriaId": "D1B12C7E-0819-472E-8E79-477B47D603DD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:vmware:cloud_foundation_operations:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1A8C1A33-352A-4F7E-A284-F966F21EB0B3"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:vmware:open_vm_tools:*:*:*:*:*:*:*:*",
"versionStartIncluding": "11.2.0",
"versionEndExcluding": "12.5.4",
"matchCriteriaId": "3A809AD4-BFBA-4618-84A2-E638C13DC01F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:vmware:open_vm_tools:13.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7F8B48DE-44C4-4581-A52F-5631B0EB33E6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:vmware:telco_cloud_infrastructure:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.2",
"versionEndIncluding": "3.0",
"matchCriteriaId": "904AA81A-D1C3-4DAF-BB2C-C51FEDF5B3F6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:vmware:telco_cloud_platform:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.0",
"versionEndExcluding": "5.0.1",
"matchCriteriaId": "A9C444F9-5647-451F-B239-252841E440C7"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
}
]
}
]
},
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:vmware:tools:*:*:*:*:*:*:*:*",
"versionStartIncluding": "12.5.0",
"versionEndExcluding": "12.5.4",
"matchCriteriaId": "15832760-0347-4BB8-9B78-DE47CBE21957"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:vmware:tools:*:*:*:*:*:*:*:*",
"versionStartIncluding": "13.0.0.0",
"versionEndExcluding": "13.0.5.0",
"matchCriteriaId": "60F4C0D6-B650-4BE4-9E8F-DBFCFF7D8390"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
"matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
}
]
}
]
}
],
"references": [
{
"url": "http://support.broadcom.com/group/ecx/support-content-view/-/support-content/Security%20Advisories/VMSA-2025-0015--VMware-Aria-Operations-and-VMware-Tools-updates-address-multiple-vulnerabilities--CVE-2025-41244-CVE-2025-41245--CVE-2025-41246-/36149",
"source": "[email protected]",
"tags": [
"Permissions Required"
]
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/09/29/10",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
]
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00000.html",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
]
},
{
"url": "https://blog.nviso.eu/2025/09/29/you-name-it-vmware-elevates-it-cve-2025-41244/",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Third Party Advisory"
]
},
{
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36149",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-41244",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"US Government Resource"
]
}
]
}