CVE-2025-41251 — Weak Password Recovery Mechanism for Forgotten Password in Vmware NSX
Severity
8.1HIGHNVD
EPSS
0.1%
top 81.89%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedSep 29
Latest updateSep 30
Description
VMware NSX contains a weak password recovery mechanism vulnerability. An unauthenticated malicious actor may exploit this to enumerate valid usernames, potentially enabling brute-force attacks.
Impact: Username enumeration → credential brute force risk.
Attack Vector: Remote, unauthenticated.
Severity: Important.
CVSSv3: 8.1 (High).
Acknowledgments: Reported by the National Security Agency.
Affected Products:VMware NSX 9.x.x.x, 4.2.x, 4.1.x, 4.0.x
NSX-T 3.x
VMware Cloud Foundation (with NSX)…
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9
Affected Packages1 packages
▶CVEListV5vmware/nsxVMware Cloud Foundation (with NSX) - 5.x, 4.5.x, VMware NSX - 9.x.x.x, 4.2.x, 4.1.x, 4.0.x, VMware NSX-T - 3.x+2