CVE-2025-41225 — OS Command Injection in Vmware Vcenter Server

CWE-78 — OS Command Injection3 documents3 sources
Severity
8.8HIGHNVD
EPSS
0.1%
top 68.42%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Vmware Vcenter ServerVmware Cloud FoundationVmware Telco Cloud Infrastructure+1 more
Timeline
PublishedMay 20

Description

The vCenter Server contains an authenticated command-execution vulnerability. A malicious actor with privileges to create or modify alarms and run script action may exploit this issue to run arbitrary commands on the vCenter Server.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HExploitability: 2.0 | Impact: 6.0

Affected Packages4 packages

▶CVEListV5vmware/vcenter_server8.0 — 8.0 U3e+1
▶CVEListV5vmware/cloud_foundation5.x, 4.5.x
▶CVEListV5vmware/telco_cloud_platform5.x, 4.x, 3.x, 2.x

🔴Vulnerability Details

2
CVEList
VMware vCenter Server authenticated command-execution vulnerability↗2025-05-20
▶
GHSA
GHSA-2687-xwfr-5fx9: The vCenter Server contains an authenticated command-execution vulnerability↗2025-05-20
▶
CVE-2025-41225 — OS Command Injection in Vmware | cvebase