VMware Tools and CrushFTP Security Flaws With No Workaround | How to Protect Your Systems

Key takeaways

• CVE-2025-22230 is an authentication bypass in VMware Tools for Windows that lets a low-privilege guest user perform privileged actions.
• The fix is to update VMware Tools to the patched release from Broadcom.
• Unpatched management tools are a common foothold, so include them in your patch inventory.

Table of Contents

• Introduction
• VMware Tools Security Flaw (CVE-2025-22230)
• CrushFTP Vulnerability: Unauthenticated HTTP(S) Port Access
• Why These Vulnerabilities Matter
• How to Secure Your Systems
• Conclusion

Introduction

Recent security vulnerabilities in VMware Tools for Windows and CrushFTP have raised significant cybersecurity concerns. These flaws could allow authentication bypass and unauthorized access, putting sensitive systems at risk. Broadcom has released security patches for VMware Tools, but there are no workarounds for these issues. CrushFTP has also disclosed an unauthenticated HTTP(S) port access vulnerability.

These security flaws have risks, affected versions, and necessary security measures. Organisations must take immediate action to secure their systems against these high-risk vulnerabilities.

VMware Tools Security Flaw (CVE-2025-22230)

What is the VMware Tools Vulnerability?

A critical authentication bypass vulnerability has been identified in VMware Tools for Windows, tracked as CVE-2025-22230. It allows a non-administrative user on a Windows guest VM to perform high-privilege operations due to improper access control.

Severity and Impact

• CVE-2025-22230 is rated 7.8 on the CVSS scale, making it a high-severity vulnerability.

• If exploited, a malicious user could bypass authentication and perform privileged actions within a virtual machine (VM).

• The flaw affects VMware Tools versions 11.x.x and 12.x.x.

Who Discovered the Flaw?

• The vulnerability was discovered and reported by Sergey Bliznyuk from Positive Technologies, a cybersecurity firm based in Russia.

Is There a Fix?

• Broadcom has released VMware Tools version 12.5.1, which addresses this vulnerability.

• There are no workarounds for this issue, making it important for users to update their systems immediately.

CrushFTP Vulnerability: Unauthenticated HTTP(S) Port Access

What is the CrushFTP Security Flaw?

A newly discovered vulnerability in CrushFTP versions 10 and 11 allows unauthenticated users to access HTTP(S) ports. This could lead to data breaches, unauthorized system access, and potential exploitation by hackers.

Severity and Risk

• The vulnerability has not been assigned a CVE yet, but it poses a serious security risk.

• Attackers can exploit the flaw to gain unauthorized access to CrushFTP servers via exposed HTTP(S) ports.

• Although not actively exploited in the wild, it remains a significant threat.

Mitigation and Fixes

• CrushFTP has confirmed that if the DMZ function is enabled, the vulnerability is not exploitable.

• Users should immediately update to the latest version of CrushFTP and enable security configurations to mitigate risk.

Why These Vulnerabilities Matter

Potential Threats

Both vulnerabilities pose serious security risks, including:

• Unauthorized access to virtual machines and sensitive data.

• Privilege escalation, where attackers gain higher-level access to systems.

• Remote exploitation, allowing attackers to compromise servers and spread malware.

Previous Exploits of VMware and CrushFTP

• VMware security flaws have previously been exploited in cyberattacks, leading to data breaches and ransomware infections.

• CrushFTP vulnerabilities have also been targeted by hackers looking to exploit weak configurations.

How to Secure Your Systems

Conclusion

The VMware Tools and CrushFTP vulnerabilities are high-risk security flaws that require immediate action. Organizations using VMware virtual machines and CrushFTP servers should apply the necessary patches to prevent potential cyberattacks. Since there are no workarounds, updating to the latest versions is the only way to mitigate these threats.

Cybersecurity teams should stay informed, follow best practices, and ensure continuous monitoring to protect against these and future vulnerabilities.

Related reading

• CVE-2024-55633 Explained: What You Need to Know About the Apache Superset Security Flaw
• What Is the Latest Palo Alto GlobalProtect VPN Vulnerability Allowing Privilege Escalation in 2026?
• 12-Year-Old Sudo Vulnerability CVE-2025-32462 Allows Root Access on Linux Systems

Reference

For the authoritative details, see National Vulnerability Database.