PT-2025-12803 · Vmware · Vmware Tools

Published 2025-03-25 · Updated 2026-01-10 · CVE-2025-22230

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VMware Tools for Windows versions 11.x.x through 12.x.x

Description VMware Tools for Windows contains an authentication bypass vulnerability due to improper access control. A malicious actor with non-administrative privileges on a guest VM may gain the ability to perform certain high-privilege operations within that VM. Exploitation in the wild has been reported.

Recommendations Update VMware Tools for Windows to version 12.5.1.

Fix

LPE

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

BDU:2025-03269

CVE-2025-22230

Affected Products

Vmware Tools

References · 89

• https://nvd.nist.gov/vuln/detail/CVE-2025-22230 · Security Note
• https://bdu.fstec.ru/vul/2025-03269 · Security Note
• https://twitter.com/rfwaveio/status/1905244367134048717 · Twitter Post
• https://twitter.com/ciberconsejo/status/1904852963757109486 · Twitter Post
• https://twitter.com/blackwired32799/status/1905077311629861020 · Twitter Post
• https://twitter.com/Carlos_LopezMkt/status/1906302159651500255 · Twitter Post
• https://t.me/pentestingnews/58493 · Telegram Post
• https://twitter.com/CCBalert/status/1904916733694996938 · Twitter Post
• https://twitter.com/_cvereports/status/1904600505910730829 · Twitter Post
• https://twitter.com/akaclandestine/status/1949127664855364063 · Twitter Post
• https://twitter.com/mukesh_one/status/1904765748695699921 · Twitter Post
• https://twitter.com/proficioinc/status/1906028581425410162 · Twitter Post
• https://t.me/true_secator/6877 · Telegram Post
• https://twitter.com/securityRSS/status/1904764847599866172 · Twitter Post
• https://twitter.com/WolfgangSesin/status/1904549028806697382 · Twitter Post