CVE-2025-22245 Overview
CVE-2025-22245 is a stored Cross-Site Scripting (XSS) vulnerability in VMware NSX, disclosed by Broadcom. The flaw resides in the router port component and stems from improper input validation [CWE-79]. An authenticated attacker with high privileges can inject malicious script content that persists in the NSX management interface. When another administrator views the affected router port, the stored payload executes in their browser session.
The vulnerability affects VMware NSX, VMware Cloud Foundation, VMware Telco Cloud Infrastructure, and VMware Telco Cloud Platform. Broadcom published Security Advisory #25738 to address the issue.
Critical Impact
An authenticated attacker can store malicious JavaScript in NSX router port fields, executing arbitrary script in the context of other administrators who view the data.
Affected Products
- Broadcom VMware NSX (including version 4.2.2)
- VMware Cloud Foundation
- VMware Telco Cloud Infrastructure
- VMware Telco Cloud Platform
Discovery Timeline
- 2025-06-04 - CVE-2025-22245 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-22245
Vulnerability Analysis
The vulnerability is a stored XSS flaw located in the router port functionality of VMware NSX. NSX fails to properly validate and sanitize user-supplied input before persisting it to the management database. When the data is later rendered in the NSX Manager user interface, the browser interprets the injected content as executable script rather than inert text.
Exploitation requires an authenticated session with high privileges on the NSX Manager. The attack also requires user interaction, meaning a second administrator must view the poisoned router port object for the payload to execute. Because the payload is stored server-side, every user visiting the affected view can trigger execution until the malicious entry is removed.
The scope is marked as changed, indicating that script executed in the victim's browser can affect resources beyond the vulnerable NSX component. Successful execution can lead to session token theft, forged administrative actions, or redirection to attacker-controlled infrastructure.
Root Cause
The root cause is improper input validation on router port attributes. Input fields do not enforce strict allow-lists or encode HTML-sensitive characters such as <, >, and " before storage or rendering, allowing script tags and event-handler attributes to persist in the database.
Attack Vector
The attack vector is network-based through the NSX management plane. An attacker with existing high-privilege credentials submits crafted input to a router port field. A separate authenticated administrator later views the object through the NSX Manager UI, triggering script execution in their browser context. See the Broadcom Security Advisory #25738 for component-level details.
Detection Methods for CVE-2025-22245
Indicators of Compromise
- Router port objects in NSX containing HTML tags, <script> elements, or JavaScript event handlers such as onerror= or onload= in name, description, or tag fields.
- Unexpected outbound requests from administrator browsers to unknown domains shortly after accessing NSX Manager.
- NSX audit logs showing router port create or update operations from accounts that do not normally manage networking objects.
Detection Strategies
- Query the NSX API for router port configurations and inspect text fields for angle brackets, encoded script content, or unusual Unicode escapes.
- Correlate NSX Manager session activity with browser telemetry to detect script execution originating from the management console.
- Monitor for anomalous API calls or configuration changes performed under administrator sessions immediately after viewing specific router port objects.
Monitoring Recommendations
- Enable verbose audit logging on NSX Manager and forward events to a centralized SIEM for retention and correlation.
- Alert on modifications to router port metadata fields made by accounts outside the expected change-management workflow.
- Review Content Security Policy (CSP) violation reports from browsers used to access NSX Manager.
How to Mitigate CVE-2025-22245
Immediate Actions Required
- Apply the fixed versions published in Broadcom Security Advisory #25738 to all affected NSX, Cloud Foundation, and Telco Cloud deployments.
- Audit existing router port objects for stored script content and remove or sanitize any suspicious entries.
- Rotate NSX administrator credentials and invalidate active sessions if compromise is suspected.
Patch Information
Broadcom addressed CVE-2025-22245 through Security Advisory #25738. Administrators should consult the advisory for the complete list of fixed versions across VMware NSX, VMware Cloud Foundation, VMware Telco Cloud Infrastructure, and VMware Telco Cloud Platform, then schedule updates according to vendor guidance.
Workarounds
- Restrict NSX Manager access to a dedicated administrative network segment and enforce multi-factor authentication for all privileged accounts.
- Limit the number of accounts holding high-privilege roles capable of modifying router port configurations.
- Require administrators to access NSX Manager from hardened browsers with script-blocking extensions and strict Content Security Policy enforcement until patching is complete.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
