$ cve CVE-2010-4297 JSON

CVE-2010-4297 EXPLOIT

7.2

HIGH · CVSS 2.0 · EPSS 5.2% (pctl 92)

Patch early

A public exploit exists.

Description

The VMware Tools update functionality in VMware Workstation 6.5.x before 6.5.5 build 328052 and 7.x before 7.1.2 build 301548; VMware Player 2.5.x before 2.5.5 build 328052 and 3.1.x before 3.1.2 build 301548; VMware Server 2.0.2; VMware Fusion 2.x before 2.0.8 build 328035 and 3.1.x before 3.1.2 build 332101; VMware ESXi 3.5, 4.0, and 4.1; and VMware ESX 3.0.3, 3.5, 4.0, and 4.1 allows host OS users to gain privileges on the guest OS via unspecified vectors, related to a "command injection" issue.

Scoring

CVSS	7.2 (HIGH, v2.0)
Vector	AV:L/AC:L/Au:N/C:C/I:C/A:C
EPSS	5.17% — more likely to be exploited than 92% of all CVEs
Weakness	CWE-20
On CISA KEV	no
Public exploit	yes
Published	2010-12-06
Last modified	2026-06-16

Affected (6)

Vendor	Product
vmware	esx
vmware	esxi
vmware	fusion
vmware	player
vmware	server
vmware	workstation

Public exploits

Source	Title	Date
exploit-db	VMware Tools - Update OS Command Injection	2010-12-09

References

→ the Explorer · watch your stack · NVD