CVE-2019-5543

CVE-2019-5543 is a local privilege escalation vulnerability affecting VMware Horizon Client for Windows (5.x and prior before 5.3.0), VMware Remote Console for Windows (10.x before 11.0.0), and VMware Workstation for Windows (15.x before 15.5.2). The vulnerability stems from world-writable permissions on the configuration folder for the VMware USB arbitration service. This allows a local user to execute arbitrary commands as any other user on the system. Rated with a CVSS score of 7.8 (HIGH), this vulnerability has a low attack complexity and requires local user privileges, but can lead to high impact on confidentiality, integrity, and availability. While the EPSS score is low, indicating a low probability of exploitation, the FAUCET Risk Score is 55/100, suggesting moderate risk. Currently, there is no evidence of active exploitation in the wild, and no public exploit code is available on platforms like Metasploit, Nuclei, or ExploitDB. However, there has been some community discussion and media coverage, including an article from SecurityWeek highlighting the critical nature of the flaw.