VMware ESXi 7.0 / 8.0 Multiple Vulenerabilities (VMSA-2025-0010)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(237246);
  script_version("1.6");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/16");

  script_cve_id("CVE-2025-41226", "CVE-2025-41227", "CVE-2025-41228");
  script_xref(name:"IAVA", value:"2025-A-0367-S");

  script_name(english:"VMware ESXi 7.0 / 8.0 Multiple Vulenerabilities (VMSA-2025-0010)");

  script_set_attribute(attribute:"synopsis", value:
"The VMware ESXi is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of VMware ESXi installed on the remote host is 7.0.x prior to 7.0 Update 3v or 8.0.x prior to 8.0 Update 
3e. It is, therefore, affected by multiple vulnerabilities as referenced in the VMSA-2025-0010 advisory.

  - ESXi contains a denial-of-service vulnerability that occurs when performing a guest operation. 
    (CVE-2025-41226)

  - Workstation, Fusion and ESXi contain a denial-of-service vulnerability due to certain guest options. 
    (CVE-2025-41227)

  - VMware ESXi and vCenter Server contain a reflected cross-site scripting vulnerability due to improper 
    input validation. (CVE-2025-41228)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25717
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c8ce45e5");
  script_set_attribute(attribute:"solution", value:
"Upgrade to ESXi 7.0 Update 3v, 8.0 Update 3e or later.");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-41226");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/05/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/05/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/05/26");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:vmware:esxi");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("vmware_vsphere_detect.nbin");
  script_require_keys("Host/VMware/version", "Host/VMware/release", "Host/VMware/vsphere");

  exit(0);
}

var fixes = make_array(
    '7.0', 24723868,
    '8.0', 24659227
);

var fixed_display = make_array(
    # 7.0U3 24723868 is security only
    # 7.0U3 24723872 is security + bugfix
    '7.0', '7.0U3 24723868',
    # 8.0U3 24659227 is security only
    # 8.0U3 24674464 is security + bugfix
    '8.0', '8.0U3 24659227'
);

var rel = get_kb_item_or_exit('Host/VMware/release');
if ('ESXi' >!< rel) audit(AUDIT_OS_NOT, 'ESXi');

var ver = get_kb_item_or_exit('Host/VMware/version');
var port  = get_kb_item_or_exit('Host/VMware/vsphere');

# 24416880 is a special ESX build for Mobility Agent 
if ("24416880" >< rel) audit(AUDIT_INST_VER_NOT_VULN, 'VMware ESXi', ver);

var match = pregmatch(pattern:"^ESXi? ([0-9]+\.[0-9]+).*$", string:ver);

if (isnull(match)) audit(AUDIT_UNKNOWN_BUILD, 'VMware ESXi', '7.0 / 8.0');
ver = match[1];

if (ver !~ "^(7\.0|8\.0)$") audit(AUDIT_OS_NOT, 'ESXi 7.0 / 8.0');

var fixed_build = fixes[ver];

if (empty_or_null(fixed_build)) audit(AUDIT_VER_FORMAT, ver);

match = pregmatch(pattern:"^VMware ESXi.*build-([0-9]+)$", string:rel);
if (isnull(match)) audit(AUDIT_UNKNOWN_BUILD, 'VMware ESXi', '7.0 / 8.0');

var build = int(match[1]);

if (build >= fixed_build) audit(AUDIT_INST_VER_NOT_VULN, 'VMware ESXi', ver + ' build ' + build);

var report = '\n  ESXi version    : ' + ver +
         '\n  Installed build : ' + build +
         '\n  Fixed build     : ' + fixed_display[ver] +
         '\n';

security_report_v4(port:port, severity:SECURITY_WARNING, extra:report);