InfoSecBulletin Cybersecurity for mankind
A newly patched security flaw in Broadcom VMware Tools and VMware Aria Operations has been exploited by a threat actor named UNC5174 since mid-October 2024, according to NVISO Labs.
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Cyber attack causes French bank Credit Mutuel Arkea €100 million missing
OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours
Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw
WinRAR, WordPress RCE flaw & Zyxel GS1900 Zero-Day exploited in the wild
The vulnerability identified as CVE-2025-41244 (CVSS score: 7.8) is a flaw that allows local privilege escalation, impacting the following versions –
VMware Cloud Foundation 4.x and 5.x
VMware Cloud Foundation 9.x.x.x
VMware Cloud Foundation 13.x.x.x (Windows, Linux)
VMware vSphere Foundation 9.x.x.x
VMware vSphere Foundation 13.x.x.x (Windows, Linux)
VMware Aria Operations 8.x
VMware Tools 11.x.x, 12.x.x, and 13.x.x (Windows, Linux)
VMware Telco Cloud Platform 4.x and 5.x
VMware Telco Cloud Infrastructure 2.x and 3.x
“A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM,” VMware said in an advisory released Monday.
Local privilege escalation means the attacker must gain access to the infected device in another way.
Maxime Thiebaut from NVISO discovered a flaw on May 19, 2025, during an incident response. VMware Tools version 12.4.9, included in 12.5.4, fixes the issue for Windows 32-bit systems. Linux vendors will also provide an open-vm-tools version that addresses CVE-2025-41244.
Broadcom hasn’t confirmed any real-world exploitation, but NVISO Labs linked the activity to a China-associated group called UNC5174, tracked by Google Mandiant. This group is known for exploiting security vulnerabilities in Ivanti and SAP NetWeaver for initial access.
“When successful, exploitation of the local privilege escalation results in unprivileged users achieving code execution in privileged contexts (e.g., root),” Thiebaut said. “We can however not assess whether this exploit was part of UNC5174’s capabilities or whether the zero-day’s usage was merely accidental due to its trivialness.”
The vulnerability comes from a function called “get_version()” that uses a regular expression to check if a process with a listening socket matches a certain pattern, then it runs the version command for that service.
“While this functionality works as expected for system binaries (e.g., /usr/bin/httpd), the usage of the broad‑matching \S character class (matching non‑whitespace characters) in several of the regex patterns also matches non-system binaries (e.g., /tmp/httpd),” Thiebaut explained. “These non-system binaries are located within directories (e.g., /tmp) which are writable to unprivileged users by design.”
This vulnerability allows a local attacker to exploit a malicious binary at “/tmp/httpd,” leading to privilege escalation when the VMware metrics service runs. The attacker just needs the binary to be executed by an unprivileged user and to open a random listening socket.
A Brussels cybersecurity firm reported that UNC5174 used “/tmp/httpd” to store a malicious file, gaining elevated root access and executing code. The specifics of the payload executed are currently unknown.
“The broad practice of mimicking system binaries (e.g., httpd) highlights the real possibility that several other malware strains have accidentally been benefiting from unintended privilege escalations for years,” Thiebaut said.
