CVE-2025-41250

Full vulnerability record from the local CVENow database.

Description

VMware vCenter contains an SMTP header injection vulnerability. A malicious actor with non-administrative privileges on vCenter who has permission to create scheduled tasks may be able to manipulate the notification emails sent for scheduled tasks.

Severity

HIGH

CVSS score

8.5 (v3.1)

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2025-09-29 18:15:31.460000

Last modified

2026-10-18 21:10:00.120000

View original CVE JSON

{
  "id": "CVE-2025-41250",
  "sourceIdentifier": "[email protected]",
  "published": "2025-09-29T18:15:31.460",
  "lastModified": "2026-10-18T21:10:00.120",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "VMware vCenter contains an SMTP header injection vulnerability. A malicious actor with non-administrative privileges on vCenter who has permission to create scheduled tasks may be able to manipulate the notification emails sent for scheduled tasks."
    },
    {
      "lang": "es",
      "value": "VMware vCenter contiene una vulnerabilidad de inyección de encabezado SMTP. Un actor malicioso con privilegios no administrativos en vCenter que tiene permiso para crear tareas programadas podría manipular los correos electrónicos de notificación enviados para tareas programadas."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "VMware",
          "product": "vCenter",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "8.0",
              "lessThan": "8.0 U3g",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "7.0",
              "lessThan": "7.0 U3w",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "VMware",
          "product": "Cloud Foundation",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "9.x.x.x",
              "lessThan": "9.0.1.0",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "5.x",
              "lessThan": "5.2.2",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "4.5.x",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "VMware",
          "product": "Telco Cloud Platform",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "5.x, 4.x, 3.x, 2.x",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "VMware",
          "product": "Telco Cloud Infrastructure",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "3.x, 2.x",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "VMware",
          "product": "vSphere Foundation",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "9.x.x.x",
              "lessThan": "9.0.1.0",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L",
          "baseScore": 8.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 4.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-30T03:55:12.907714Z",
          "id": "CVE-2025-41250",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36150",
      "source": "[email protected]"
    }
  ]
}