Urgent: China-Linked Hackers Exploit New VMware Zero-Day Since October 2024

A newly patched flaw affecting Broadcom VMware Tools and VMware Aria Operations has been exploited in the wild as a zero-day since mid-October 2024 by a threat actor named UNC5174, according to NVISO Labs. The vulnerability, CVE-2025-41244, carries a CVSS score of 7.8 and impacts a range of VMware products including VMware Tools, Aria Operations, vSphere Foundation, Cloud Foundation, and Telco Cloud components.

VMware said in an advisory released on Monday that a malicious local actor with non-administrative privileges who has access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may escalate privileges to root on the same VM.

NVISO noted Maxime Thiebaut’s discovery and reporting of the flaw on 19 May 2025 during an incident response engagement, and that VMware Tools 12.4.9 (within 12.5.4) remediates the issue for Windows 32-bit systems, with open-vm-tools updates forthcoming from Linux vendors. The attack path involves staging a malicious binary at /tmp/httpd and obtaining code execution via a running VMware metrics process, enabling potential privilege escalation for unprivileged users.