Privilege Escalation Vulnerability in VMware Workstation and Player
CVE-2016-7086

7.8HIGH

Key Information:

Vendor

Vmware
Status
Workstation Player
Workstation Pro
Vendor
CVE Published:
29 December 2016

What is CVE-2016-7086?

The installer for VMware Workstation Pro and Player versions prior to 12.5.0 on Windows contains a vulnerability that allows local users to escalate privileges. This arises from the presence of a Trojan horse named setup64.exe in the installation directory, which can be exploited to gain unauthorized access and perform actions with heightened privileges. Users are advised to update to the latest version to mitigate the risk of exploitation.

References

http://www.vmware.com/security/advisories/VMSA-2016-0014....
x_refsource_CONFIRM
http://www.securitytracker.com/id/1036805
vdb-entryx_refsource_SECTRACK
http://www.securityfocus.com/bid/92941
vdb-entryx_refsource_BID

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.