VMware Tools for Windows Improper Authorization Vulnerability Allowing Access to Other Guest VMs

A vulnerability has been identified in VMware Tools for Windows, specifically in versions 13.x and 12.x prior to 12.5.4. This vulnerability arises from improper authorization in user access controls, allowing a malicious actor with non-administrative privileges on a guest VM to access other guest VMs. Exploitation requires authentication through vCenter or ESX and knowledge of the targeted VMs' credentials.

Impact

Exploitation of this vulnerability could lead to unauthorized access to other guest VMs from the compromised VM.

Remediation

Users can upgrade to VMware Tools version 13.0.5.0 or 12.5.4, depending on their current version. VMware Tools 12.4.9, part of VMware Tools 12.5.4, also addresses this issue for Windows 32-bit.