CVE-2025-41251
Gravedad CVSS v3.1:
ALTA
Tipo:
CWE-640
Mecanismo débil para recuperación de contraseñas olvidadas
Fecha de publicación:
29/09/2025
Última modificación:
29/09/2025
Descripción
*** Pendiente de traducción *** VMware NSX contains a weak password recovery mechanism vulnerability. An unauthenticated malicious actor may exploit this to enumerate valid usernames, potentially enabling brute-force attacks.<br />
<br />
Impact: Username enumeration → credential brute force risk.<br />
Attack Vector: Remote, unauthenticated.<br />
Severity: Important.<br />
CVSSv3: 8.1 (High).<br />
<br />
Acknowledgments: Reported by the National Security Agency.<br />
<br />
Affected Products:VMware NSX 9.x.x.x, 4.2.x, 4.1.x, 4.0.x<br />
<br />
NSX-T 3.x<br />
VMware Cloud Foundation (with NSX) 5.x, 4.5.x<br />
<br />
Fixed Versions: NSX 9.0.1.0; 4.2.2.2/4.2.3.1 http://4.2.2.2/4.2.3.1 ; 4.1.2.7; NSX-T 3.2.4.3; CCF async patch (KB88287).<br />
Workarounds: None.
Impacto
Puntuación base 3.x
8.10
Gravedad 3.x
ALTA