VMware VCenter Server 命令执行漏洞(CVE-2025-41225)

VMware vCenter Server是一款领先的虚拟化管理平台，为企业提供了集中管理和自动化虚拟化环境的功能。作为VMware vSphere虚拟化平台的核心组件，vCenter Server可以实现对虚拟机、存储、网络和其他虚拟化资源的全面管理和监控。它提供了高级的虚拟机管理功能、灵活的资源调度和性能优化工具，同时支持自动化任务和虚拟化环境的安全性管理。该漏洞在于权限校验不充分的情况下，允许具有创建或修改警报权限的认证用户通过脚本操作执行任意命令。

7.0 <= VMware vCenter Server < 7.0U3v

8.0 <= VMware vCenter Server < 8.0U3e

5.x <= VMware Cloud Foundation (vCenter) < 8.0U3e

4.5.x <= VMware Cloud Foundation (vCenter) < 7.0U3v

5.x/4.x/3.x/2.x <= VMware Telco Cloud Platform (vCenter)  < 8.0 U3e

3.x <= VMware Telco Cloud Infrastructure (vCenter) < 8.0 U3e

2.x <= VMware Telco Cloud Infrastructure (vCenter) < 7.0 U3v

VMware vCenter Server >= 7.0U3v

VMware vCenter Server >= 8.0U3e

VMware Telco Cloud Platform (vCenter) 5.x/4.x/3.x/2.x >= 8.0 U3e

VMware Telco Cloud Infrastructure (vCenter) 3.x >= 8.0 U3e

VMware Telco Cloud Infrastructure (vCenter) 2.x >= 7.0 U3v

https://support.broadcom.com/web/ecx/solutiondetails?patchId=5826

https://support.broadcom.com/web/ecx/solutiondetails?patchId=5849

1.https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25717