CVE-2025-41250— Header injection vulnerability
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-41250
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Header injection vulnerability
Source: NVD (National Vulnerability Database)
Vulnerability Description
VMware vCenter contains an SMTP header injection vulnerability. A malicious actor with non-administrative privileges on vCenter who has permission to create scheduled tasks may be able to manipulate the notification emails sent for scheduled tasks.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
在命令中使用的特殊元素转义处理不恰当(命令注入)
Source: NVD (National Vulnerability Database)
Vulnerability Title
VMware vCenter 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
VMware vCenter是美国威睿（VMware）公司的一款虚拟化管理软件。 VMware vCenter存在安全漏洞，该漏洞源于SMTP标头注入，可能导致操纵计划任务的通知邮件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| VMware | vCenter | 8.0 ~ 8.0 U3g | - | |
| VMware | Cloud Foundation | 9.x.x.x ~ 9.0.1.0 | - | |
| VMware | Telco Cloud Platform | 5.x, 4.x, 3.x, 2.x | - | |
| VMware | Telco Cloud Infrastructure | 3.x, 2.x | - | |
| VMware | vSphere Foundation | 9.x.x.x ~ 9.0.1.0 | - |
II. Public POCs for CVE-2025-41250
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-41250
请登录查看更多情报信息。
Same Patch Batch · VMware · 2025-09-29 · 6 CVEs total
| CVE-2025-41251 | 8.1 HIGH | Weak password recovery vulnerability |
| CVE-2025-41244 | 7.8 HIGH | VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabi |
| CVE-2025-41246 | 7.6 HIGH | Improper authorisation vulnerability |
| CVE-2025-41252 | 7.5 HIGH | Username enumeration vulnerability |
| CVE-2025-41245 | 4.9 MEDIUM | VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabi |
IV. Related Vulnerabilities
Same product: vCenter
Same vendor: VMware
- CVE-2026-22745
CVE-2026-22745 : Denial of service in static resource handli - CVE-2026-22741
Static resource cache poisoning in Spring MVC and WebFlux - CVE-2026-22740
Spring Framework DoS with Multipart Temp Files in WebFlux - CVE-2026-40966
VectorStoreChatMemoryAdvisor conversation scoping can lead t - CVE-2026-22750
SSL bundle configuration silently bypassed in Spring Cloud G
Same weakness: CWE-77
- CVE-2026-8210
aandrew-me tgpt Update helper.go helper.Update command injec - CVE-2026-42258
net-imap: Command Injection via unvalidated Symbol inputs - CVE-2026-42453
Termix: Command injection in extractArchive/compressFiles vi - CVE-2026-42271
LiteLLM: Authenticated command execution via MCP stdio test - CVE-2026-41500
electerm has Command Injection Vulnerability via runMac func
V. Comments for CVE-2025-41250
No comments yet