CVE-2025-41251

VMware NSX contains a weak password recovery mechanism vulnerability. An unauthenticated malicious actor may exploit this to enumerate valid usernames, potentially enabling brute-force attacks. Impact: Username enumeration → credential brute force risk. Attack Vector: Remote, unauthenticated. Severity: Important. CVSSv3: 8.1 (High). Acknowledgments: Reported by the National Security Agency. Affected Products:VMware NSX 9.x.x.x, 4.2.x, 4.1.x, 4.0.x NSX-T 3.x VMware Cloud Foundation (with NSX) 5.x, 4.5.x Fixed Versions: NSX 9.0.1.0; 4.2.2.2/4.2.3.1 http://4.2.2.2/4.2.3.1 ; 4.1.2.7; NSX-T 3.2.4.3; CCF async patch (KB88287). Workarounds: None.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36150

Configurations

No configuration.

History

09 Oct 2026, 09:10

Type	Values Removed	Values Added
Summary		(es) VMware NSX contiene una vulnerabilidad en el mecanismo de recuperación de contraseña débil. Un actor malicioso no autenticado puede explotar esto para enumerar nombres de usuario válidos, lo que podría permitir ataques de fuerza bruta. Impacto: Enumeración de nombres de usuario ? riesgo de fuerza bruta de credenciales. Vector de ataque: Remoto, no autenticado. Severidad: Importante. CVSSv3: 8.1 (Alta). Agradecimientos: Informado por la Agencia de Seguridad Nacional. Productos afectados: VMware NSX 9.x.x.x, 4.2.x, 4.1.x, 4.0.x NSX-T 3.x VMware Cloud Foundation (con NSX) 5.x, 4.5.x Versiones corregidas: NSX 9.0.1.0; 4.2.2.2/4.2.3.1 http://4.2.2.2/4.2.3.1 ; 4.1.2.7; NSX-T 3.2.4.3; parche asíncrono de CCF (KB88287). Soluciones alternativas: Ninguna.

Information

Published : 2025-09-29 19:15

Updated : 2026-10-09 09:10

NVD link : CVE-2025-41251

Mitre link : CVE-2025-41251

CVE.ORG link : CVE-2025-41251

JSON object : View

Products Affected

No product.

CWE

CWE-640

Weak Password Recovery Mechanism for Forgotten Password

{"id": "CVE-2025-41251", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-41251", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-09-30T03:55:13.799400Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@vmware.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security@vmware.com", "affectedData": [{"vendor": "vmware", "product": "NSX", "versions": [{"status": "affected", "version": "VMware NSX - 9.x.x.x, 4.2.x, 4.1.x, 4.0.x", "versionType": "custom"}, {"status": "affected", "version": "VMware NSX-T - 3.x", "versionType": "custom"}, {"status": "affected", "version": "VMware Cloud Foundation (with NSX) - 5.x, 4.5.x", "versionType": "custom"}, {"status": "unaffected", "version": "VMware NSX 9.0.1.0; 4.2.2.2/4.2.3.1; 4.1.2.7; NSX-T 3.2.4.3; CCF async patch (KB88287)", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2025-09-29T19:15:35.157", "references": [{"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36150", "source": "security@vmware.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@vmware.com", "description": [{"lang": "en", "value": "CWE-640"}]}], "descriptions": [{"lang": "en", "value": "VMware NSX contains a weak password recovery mechanism vulnerability. An unauthenticated malicious actor may exploit this to enumerate valid usernames, potentially enabling brute-force attacks.\n\nImpact:\u00a0Username enumeration \u2192 credential brute force risk.\nAttack Vector:\u00a0Remote, unauthenticated.\nSeverity:\u00a0Important.\nCVSSv3:\u00a08.1 (High).\n\nAcknowledgments:\u00a0Reported by the National Security Agency.\n\nAffected Products:VMware NSX 9.x.x.x, 4.2.x, 4.1.x, 4.0.x\n\nNSX-T 3.x\nVMware Cloud Foundation (with NSX) 5.x, 4.5.x\n\nFixed Versions: NSX 9.0.1.0; 4.2.2.2/4.2.3.1 http://4.2.2.2/4.2.3.1 ; 4.1.2.7; NSX-T 3.2.4.3; CCF async patch (KB88287).\nWorkarounds: None."}, {"lang": "es", "value": "VMware NSX contiene una vulnerabilidad en el mecanismo de recuperaci\u00f3n de contrase\u00f1a d\u00e9bil. Un actor malicioso no autenticado puede explotar esto para enumerar nombres de usuario v\u00e1lidos, lo que podr\u00eda permitir ataques de fuerza bruta.\n\nImpacto: Enumeraci\u00f3n de nombres de usuario ? riesgo de fuerza bruta de credenciales.\nVector de ataque: Remoto, no autenticado.\nSeveridad: Importante.\nCVSSv3: 8.1 (Alta).\n\nAgradecimientos: Informado por la Agencia de Seguridad Nacional.\n\nProductos afectados: VMware NSX 9.x.x.x, 4.2.x, 4.1.x, 4.0.x\n\nNSX-T 3.x\nVMware Cloud Foundation (con NSX) 5.x, 4.5.x\n\nVersiones corregidas: NSX 9.0.1.0; 4.2.2.2/4.2.3.1 http://4.2.2.2/4.2.3.1 ; 4.1.2.7; NSX-T 3.2.4.3; parche as\u00edncrono de CCF (KB88287).\nSoluciones alternativas: Ninguna."}], "lastModified": "2026-10-09T09:10:00.213", "sourceIdentifier": "security@vmware.com"}