CVE-2019-5543 json
For VMware Horizon Client for Windows (5.x and prior before 5.3.0), VMware Remote Console for Windows (10.x before 11.0.0), VMware Workstat…
published 2020-03-16 6 y ago modified 2026-06-17 4 mo ago also EUVD-2019-15118
- cvss
- 7.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 33%
- public exploits
- 0
- none known
Summary
For VMware Horizon Client for Windows (5.x and prior before 5.3.0), VMware Remote Console for Windows (10.x before 11.0.0), VMware Workstation for Windows (15.x before 15.5.2) the folder containing configuration files for the VMware USB arbitration service was found to be writable by all users. A local user on the system where the software is installed may exploit this issue to run commands as any user.
Patch / fix
- vmware horizon_client 5.3.0
- vmware remote_console 11.0.0
- vmware workstation 15.5.2
Exploit prediction
0.39% chance of exploitation in the next 30 days, higher than 33% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Affected products
- VMware VMware Horizon Client for Windows
- VMware VMware Remote Console for Windows
- VMware VMware Workstation for Windows
Classification
- Weakness
-
- CWE-732 Incorrect Permission Assignment for Critical Resource
- Technology feeds
References
-
vmware.com
/security/advisories/VMSA-2020-0004.html
vendor-advisory
Sources
- CVE List CVE-2019-5543
- NVD CVE-2019-5543
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.