PT-2025-17430 · Unknown · Ova Based Connect

Published 2025-04-21 · Updated 2025-04-21 · CVE-2025-3837

Positive Technologies (AI Summary)

CVSS v4.0

6.1

Medium

Base vector

AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions VMware End of Life OVA Connect versions prior to the end of support in January 2024

Description An improper input validation vulnerability is identified in the End of Life (EOL) OVA based connect component, which is deployed for installation purposes in the customer's internal network. This EOL component was deprecated in September 2023 with end of support extended till January 2024. Under certain circumstances, an actor can manipulate a specific request parameter and inject code execution payload, which could lead to a remote code execution on the infrastructure hosting this component.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2025-3837

Affected Products

Ova Based Connect

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-3837 · Security Note
• https://twitter.com/cybercronai/status/1914329676887077246 · Twitter Post
• https://t.me/cvenotify/119120 · Telegram Post
• https://t.me/cvedetector/23433 · Telegram Post
• https://t.me/cvetracker/22042 · Telegram Post
• https://saviynt.com/trust-compliance-security · Note
• https://twitter.com/WolfgangSesin/status/1914316896477860077 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1914270315812720746 · Twitter Post
• https://twitter.com/CVEnew/status/1914252836839243908 · Twitter Post