• mehdi@mkvlab.at

VMSA-2025-0016 – VMware vCenter and NSX – Multiple Vulnerabilities

VMware by Broadcom has released VMware vCenter and NSX updates to address multiple vulnerabilities CVE-2025-41250, CVE-2025-41251, CVE-2025-41252. Multiple vulnerabilities in VMware vCenter and NSX were privately reported to Broadcom. Updates are available to remediate these vulnerabilities in affected Broadcom products. 

Impacted Products

  • VMware NSX
  • NSX-T
  • VMware Cloud Foundation
  • VMware vCenter Server
  • VMware Telco Cloud Platform
  • VMware Telco Cloud Infrastructure

CVE-2025-41250 | vCenter SMTP header injection vulnerability

Description: 
VMware vCenter contains an SMTP header injection vulnerability. Broadcom has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 8.5. A malicious actor with non-administrative privileges on vCenter who has permission to create scheduled tasks may be able to manipulate the notification emails sent for scheduled tasks.

Resolution: 
To remediate CVE-2025-41250 apply the patches listed in the ‘Fixed Version’ column of the ‘Response Matrix’ found below.

Response Matrix CVE-2025-41250: 

VMware ProductComponentVersionCVESeverityFixed VersionWorkaroundsAdditional Documentation
VMware Cloud Foundation,VMware vSphere FoundationvCenter9.x.x.xCVE-2025-41250Important9.0.1.0NoneNone
VMware vCenterN/A8.0CVE-2025-41250Important8.0 U3gNoneNone
VMware vCenterN/A7.0CVE-2025-41250Important7.0 U3w None
VMware Cloud Foundation vCenter5.xCVE-2025-41250Important5.2.2NoneAsync Patching Guide: KB88287
VMware Cloud Foundation vCenter4.5.xCVE-2025-41250ImportantAsync patch to 7.0 U3wNoneAsync Patching Guide: KB88287
VMware Telco Cloud PlatformvCenter5.x, 4.x, 3.x, 2.xCVE-2025-41250ImportantKB411508NoneNone
VMware Telco Cloud InfrastructurevCenter3.x, 2.xCVE-2025-41250ImportantKB411508NoneNone
CVE-2025-41251 | NSX weak password recovery mechanism vulnerability

Description:
VMware NSX contains a weak password recovery mechanism vulnerability. Broadcom has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 8.1. An unauthenticated malicious actor may exploit this vulnerability to enumerate valid usernames, potentially leading to brute-force attacks.

Resolution:
To remediate CVE-2025-41251 apply the updates listed in the ‘Fixed Version’ column of the ‘Response Matrix’ below to affected deployments.

CVE-2025-41252 | NSX username enumeration vulnerability

Description:
VMware NSX contains a username enumeration vulnerability. Broadcom has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.5. An unauthenticated malicious actor may exploit this vulnerability to enumerate valid usernames, potentially leading to unauthorized access attempts.

Resolution:
To remediate CVE-2025-41252 apply the updates listed in the ‘Fixed Version’ column of the ‘Response Matrix’ below to affected deployments.

Response Matrix CVE-2025-41251 & CVE-2025-41252: 

VMware ProductComponentVersionCVESeverityFixed VersionWorkaroundsAdditional Documentation
VMware Cloud Foundation,VMware vSphere FoundationVMware NSX9.x.x.xCVE-2025-41251, CVE-2025-41252 Important9.0.1.0NoneNone
VMware NSXN/A4.2.xCVE-2025-41251, CVE-2025-41252 Important4.2.2.2, 4.2.3.1NoneNone
VMware NSXN/A4.1.x, 4.0.xCVE-2025-41251, CVE-2025-41252 Important4.1.2.7NoneNone
NSX-TN/A3.xCVE-2025-41251, CVE-2025-41252 Important3.2.4.3NoneNone
VMware Cloud Foundation VMware NSX5.xCVE-2025-41251, CVE-2025-41252 ImportantKB88287NoneAsync Patching Guide: KB88287
VMware Cloud Foundation VMware NSX4.5.xCVE-2025-41251, CVE-2025-41252 ImportantKB88287NoneAsync Patching Guide: KB88287
VMware Telco Cloud InfrastructureVMware NSX3.x, 2.x CVE-2025-41251, CVE-2025-41252 ImportantKB411518NoneNone
VMware Telco Cloud PlatformVMware NSX5.x, 4.x, 3.xCVE-2025-41251, CVE-2025-41252 ImportantKB411518NoneNone

You can also check my VMware Product Release page for more information regarding released products, release notes, and download links.

Sources:
Broadcom Blog Post

Leave a Reply

Your email address will not be published. Required fields are marked *