Cyber Resilience

CVE-2025-22230

Auth Bypass

Published
25 March 2025
Modified
15 April 2026
CVSS Score v3.1 7.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0033 26th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2025-22230 is a high-severity Authentication Bypass Using an Alternate Path or Channel (CWE-288) vulnerability in Broadcom (inferred from references). Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 26th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2025-22230 is an authentication bypass vulnerability in VMware Tools for Windows, stemming from improper access control (CWE-288). This flaw allows unauthorized elevation within the affected guest virtual machine (VM). The vulnerability received a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-03-25.

A malicious actor with non-administrative privileges on the guest VM can exploit this issue locally with low complexity and no user interaction required. Successful exploitation enables the attacker to perform certain high-privilege operations within that specific VM, potentially leading to high impacts on confidentiality, integrity, and availability.

For mitigation details, including available patches, refer to the Broadcom security advisory at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25518.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

VMware Tools for Windows contains an authentication bypass vulnerability due to improper access control. A malicious actor with non-administrative privileges on a guest VM may gain ability to perform certain high privilege operations within that VM.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

The CVE describes a local authentication bypass due to improper access control in VMware Tools, enabling a non-admin user to perform high-privilege operations within the guest VM. This directly maps to exploitation of a vulnerability for privilege escalation.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-34040Shared CWE-288
CVE-2026-26117Shared CWE-288
CVE-2025-66200Shared CWE-288
CVE-2024-26566Shared CWE-288
CVE-2026-34372Shared CWE-288
CVE-2026-1747Shared CWE-288
CVE-2026-24206Shared CWE-288
CVE-2026-24207Shared CWE-288
CVE-2025-68710Shared CWE-288
CVE-2026-5415Shared CWE-288

Affected Assets

Broadcom
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-2 Flaw Remediation
  • AC-3 Access Enforcement
  • AC-6 Least Privilege
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 7 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V6.4.3
  • V6.6.1
  • V12.1.3

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly mitigates the authentication bypass vulnerability by requiring timely identification, reporting, and patching of the flaw in VMware Tools for Windows.

prevent

Enforces approved authorizations for access to system resources, directly countering the improper access control that enables non-administrative privilege escalation within the guest VM.

prevent

Applies least privilege to restrict non-administrative users and processes, limiting the high-privilege operations achievable via the authentication bypass.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-03 full match
prevents

Requiring authentication on every channel and path directly eliminates alternate-path bypasses.

PR.AA-05 mostly match
prevents

Enforcing authorizations and least privilege across all access vectors prevents unauthenticated alternate paths.

PR.IR-01 mostly match
prevents

Protecting networks and environments from unauthorized logical access blocks bypass via undocumented channels.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing can detect alternate-path bypasses but does not prevent them in production.

degrades

Secure authentication control directly mitigates bypass by requiring strong, consistent authentication on all paths.

prevents

Access control policy directly addresses alternate authentication paths by requiring all channels to enforce authentication.

degrades

Authentication information management ensures credentials and mechanisms are consistently applied across all access paths.

prevents

Access rights provisioning and review prevent bypass via unmonitored or alternate channels.

prevents

Privileged access rights control reduces risk of bypass through elevated or alternate paths.

References