Hacked and Confused: VMware’s Zero-Day Drama Unfolds in Wild Exploitation!
A recently patched security flaw in Broadcom VMware Tools and VMware Aria Operations has been exploited in the wild as a zero-day by the crafty, China-linked threat actor UNC5174. So, while you were updating your playlists, someone was exploiting CVE-2025-41244 to escalate privileges. Talk about getting to the top the hard way!
Hot Take:
VMware just got a new nickname: “VulnerableWare.” With a CVSS score of 7.8, this zero-day flaw is like leaving your front door open and hoping no one notices. But hey, at least Broadcom and VMware can say they’re popular… with hackers!
Key Points:
- A zero-day vulnerability, CVE-2025-41244, affects multiple VMware products, allowing local privilege escalation.
- The flaw has been exploited since mid-October 2024 by a China-linked threat actor, UNC5174.
- The vulnerability is tied to the “get_version()” function, which can be manipulated using regex patterns.
- The issue is fixed in VMware Tools 12.5.4 for Windows 32-bit systems, with Linux solutions pending.
- Exploitation allows unprivileged users to execute code with root privileges by mimicking system binaries.
Already a member? Log in here