New Security Flaws Found in VMware Tools and CrushFTP — High Risk, PoC Released
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-22230 | VMware Tools for Windows contains an authentication bypass vulnerability due to improper access control. VMware Tools for Windows contains an authentication bypass vulnerability due to improper access control. A malicious actor with non-administrative privileges on a guest VM may gain ability to perform certain high privilege operations within that VM. NVD description · AI analysis pending | 7.8 | <1% | — | — | ||
| CVE-2025-2825 | Rejected reason: DO NOT USE THIS CVE RECORD. Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2025-31161. Reason: This Record is a reservation duplicate of CVE-2025-31161. Notes: All CVE users should reference CVE-2025-31161 instead of this Record. All references and descriptions in this Record have been removed to prevent accidental usage. NVD description · AI analysis pending | — | — | — | — | ||
| CVE-2025-31161 | Authentication Bypass in CrushFTP File Transfer Servers (CVE-2025-31161) CrushFTP contains an authentication bypass (CWE-305) in its handling of the HTTP authorization header, allowing crafted header values to grant access without valid credentials. A remote, unauthenticated attacker who can reach the server's HTTP/HTTPS interface can use this flaw to authenticate as any known or guessable account, such as the built-in crushadmin user. With administrative access, the attacker can typically achieve full compromise of the file-transfer server, including access to hosted files and user accounts. Any organization running CrushFTP is affected, with internet-exposed instances at the highest risk. The flaw is being actively exploited: it was added to CISA's KEV on 2025-04-07 with known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days. Do: Upgrade to the vendor's fixed releases (10.8.0 for the 10.x line and 11.3.1 for the 11.x line, per vendor advisories); federal agencies must follow BOD 22-01 timelines or discontinue use if mitigations are unavailable. Until patched, restrict network access to the CrushFTP HTTP/HTTPS interface and audit authentication logs for unexpected logins to privileged accounts such as crushadmin. Given confirmed ransomware use, treat internet-exposed instances as actively targeted and verify there are no signs of prior compromise after patching. | 9.8 | 100% | KEV ransomware PoC ×4 |
| moderate≈5,000–10,000 internet-exposed CrushFTP servers (public scan counts), with additional uncounted internal enterprise deployments |
Full article604 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMar 26, 2025Vulnerability / Data Security
Broadcom has issued security patches to address a high-severity security flaw in VMware Tools for Windows that could lead to an authentication bypass.
Tracked as CVE-2025-22230, the vulnerability is rated 7.8 on the ten-point Common Vulnerability Scoring System (CVSS).
"VMware Tools for Windows contains an authentication bypass vulnerability due to improper access control," Broadcom said in an alert issued Tuesday. "A malicious actor with non-administrative privileges on a Windows guest VM may gain the ability to perform certain high-privilege operations within that VM."
Credited with discovering and reporting the flaw is Sergey Bliznyuk of Russian cybersecurity company Positive Technologies.
CVE-2025-22230 impacts VMware Tools for Windows versions 11.x.x and 12.x.x. It has been fixed in version 12.5.1. There are no workarounds that address the issue.
CrushFTP Discloses New Flaw
The development comes as CrushFTP has warned customers of an "unauthenticated HTTP(S) port access" vulnerability affecting CrushFTP versions 10 and 11. It has yet to be assigned a CVE identifier.
"This issue affects CrushFTP v10/v11 but does not work if you have the DMZ function of CrushFTP in place," the company said. "The vulnerability was responsibly disclosed, it is not being used actively in the wild that we know of, no further details will be given at this time."
According to details shared by cybersecurity company Rapid7, successful exploitation of the vulnerability could lead to unauthenticated access via an exposed HTTP(S) port.
With security flaws in VMware and CrushFTP previously exploited by malicious actors, it's essential that users move quickly to apply the updates as soon as possible.
PoC Exploit Released for CrushFTP Flaw
The vulnerability impacting CrushFTP has been assigned the CVE identifier CVE-2025-2825. It carries a CVSS score of 9.8 out of 10, indicating critical severity.
"CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0 are affected by a vulnerability that may result in unauthenticated access," according to an advisory for the flaw. "Remote and unauthenticated HTTP requests to CrushFTP may allow attackers to gain unauthorized access."
ProjectDiscovery, in a technical write-up, said the vulnerability resides in a component that handles the ability to use Amazon S3 as the backend file system. "The vulnerability exists in the loginCheckHeaderAuth() method of ServerSessionHTTP.java, which processes HTTP requests with S3-style authorization headers," it said.
Specifically, the issue has to do with a setting called "lookup_user_pass" that's set to true by default when processing S3 authentication headers if the username doesn't contain a tilde character (~).
This allows unauthenticated attackers to bypass authentication and gain unauthorized access, entirely bypassing signature and password validation steps designed to ensure the request is authentic. A proof-of-concept (PoC) exploit has been released for CVE-2025-2825, making it essential that users apply the latest fix.
"Exploiting this vulnerability is straightforward," ProjectDiscovery said. "An attacker only needs to craft an HTTP request with: 1) An AWS S3-style authorization header with a valid username. 2) A CrushAuth cookie with matching c2f parameter values."
Exploitation Attempts Target CVE-2025-2825
The Shadowserver Foundation is warning of active exploitation attempts targeting CVE-2025-2825 following the release of the PoC. As of March 31, 2025, there are 1,394 unpatched instances vulnerable to the flaw, with 808 of them located in North America.
CrushFTP Flaw Now Tracked as CVE-2025-31161
It's worth noting that the CrushFTP flaw tracked as CVE-2025-2825 has been assigned a new CVE identifier CVE-2025-31161. For more details, refer here.
(The story was updated after publication to include details of the CVE identifier and the PoC.)
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/03/new-security-flaws-found-in-vmware.html