VMware Tools 11.x < 12.5.4 / 13.x < 13.0.5 Multiple Vulnerabilities (VMSA-2025-0015)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(266420);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/25");

  script_cve_id("CVE-2025-41244", "CVE-2025-41246");
  script_xref(name:"VMSA", value:"2025-0015");
  script_xref(name:"IAVA", value:"2025-A-0712");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2025/11/20");

  script_name(english:"VMware Tools 11.x < 12.5.4 / 13.x < 13.0.5 Multiple Vulnerabilities (VMSA-2025-0015)");

  script_set_attribute(attribute:"synopsis", value:
"The virtualization tool suite installed on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of VMware Tools installed on the remote host is 11.x or 12.x prior to 12.5.4, or 13.x prior to 13.0.5.
It is, therefore, affected by multiple vulnerabilities as disclosed in the VMSA-2025-0015 advisory:

  - VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious
  local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed
  by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the
  same VM. (CVE-2025-41244)

  - VMware Tools for Windows contains an improper authorisation vulnerability due to the way it handles user
  access controls. A malicious actor with non-administrative privileges on a guest VM, who is already
  authenticated through vCenter or ESX may exploit this issue to access other guest VMs. Successful
  exploitation requires knowledge of credentials of the targeted VMs and vCenter or ESX. (CVE-2025-41246)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36149
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c5f718a1");
  script_set_attribute(attribute:"solution", value:
"Upgrade to VMware Tools version 12.5.4, 13.0.5 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-41244");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/09/29");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/09/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/02");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:vmware:tools");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("vmware_tools_installed.nbin", "vmware_tools_nix_installed.nbin");
  script_require_keys("installed_sw/VMware Tools");

  exit(0);
}

include('vdf.inc');

# CVE-2025-41244 affects win + nix and CVE-2025-41246 affects only win, affected/fixed versions are the same
# we can do one check for win to report CVE-2025-41244 + CVE-2025-41246 and one check for nix to report CVE-2025-41244
# 32-bit Windows is patched with 12.4.9

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'VMware Tools', 'type': 'app'},
      'check_algorithm': 'default',
      'requires': [
        {'scope': 'target', 'match': {'os': 'windows'}},
        {'scope': 'target', 'match': {'arch': 'x64'}}
      ],
      'constraints' : [
        {'min_version':'11.0', 'fixed_version': '12.5.4', 'report': {'cves': ['CVE-2025-41244', 'CVE-2025-41246']}},
        {'min_version':'13.0', 'fixed_version': '13.0.5', 'report': {'cves': ['CVE-2025-41244', 'CVE-2025-41246']}}
      ]
    },
    {
      'product': {'name': 'VMware Tools', 'type': 'app'},
      'check_algorithm': 'default',
      'requires': [
        {'scope': 'target', 'match': {'os': 'windows'}},
        {'scope': 'target', 'match': {'arch': 'x86'}}
      ],
      'constraints' : [
        {'min_version':'11.0', 'fixed_version': '12.4.9', 'report': {'cves': ['CVE-2025-41244', 'CVE-2025-41246']}}
      ]
    },
    {
      'product': {'name': 'VMware Tools', 'type': 'app'},
      'check_algorithm': 'default',
      'requires': [
        {'scope': 'target', 'match': {'os': 'linux'}}
      ],
      'constraints' : [
        {'min_version':'11.0', 'fixed_version': '12.5.4', 'report': {'cves': ['CVE-2025-41244']}},
        {'min_version':'13.0', 'fixed_version': '13.0.5', 'report': {'cves': ['CVE-2025-41244']}}
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);