Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2025-22230 is a high-severity Authentication Bypass Using an Alternate Path or Channel (CWE-288) vulnerability in Broadcom (inferred from references). Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 26th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-22230 is an authentication bypass vulnerability in VMware Tools for Windows, stemming from improper access control (CWE-288). This flaw allows unauthorized elevation within the affected guest virtual machine (VM). The vulnerability received a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-03-25.
A malicious actor with non-administrative privileges on the guest VM can exploit this issue locally with low complexity and no user interaction required. Successful exploitation enables the attacker to perform certain high-privilege operations within that specific VM, potentially leading to high impacts on confidentiality, integrity, and availability.
For mitigation details, including available patches, refer to the Broadcom security advisory at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25518.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-14973
Vulnerability Data
VMware Tools for Windows contains an authentication bypass vulnerability due to improper access control. A malicious actor with non-administrative privileges on a guest VM may gain ability to perform certain high privilege operations within that VM.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a local authentication bypass due to improper access control in VMware Tools, enabling a non-admin user to perform high-privilege operations within the guest VM. This directly maps to exploitation of a vulnerability for privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the authentication bypass vulnerability by requiring timely identification, reporting, and patching of the flaw in VMware Tools for Windows.
Enforces approved authorizations for access to system resources, directly countering the improper access control that enables non-administrative privilege escalation within the guest VM.
Applies least privilege to restrict non-administrative users and processes, limiting the high-privilege operations achievable via the authentication bypass.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Requiring authentication on every channel and path directly eliminates alternate-path bypasses.
Enforcing authorizations and least privilege across all access vectors prevents unauthenticated alternate paths.
Protecting networks and environments from unauthorized logical access blocks bypass via undocumented channels.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect alternate-path bypasses but does not prevent them in production.
Secure authentication control directly mitigates bypass by requiring strong, consistent authentication on all paths.
Access control policy directly addresses alternate authentication paths by requiring all channels to enforce authentication.
Authentication information management ensures credentials and mechanisms are consistently applied across all access paths.
Access rights provisioning and review prevent bypass via unmonitored or alternate channels.
Privileged access rights control reduces risk of bypass through elevated or alternate paths.