CVE-2019-5519 is a Time-of-check Time-of-use (TOCTOU) vulnerability affecting the virtual USB 1.1 UHCI in VMware ESXi, Workstation, and Fusion. An attacker with access to a virtual machine with a virtual USB controller present could exploit this to execute code on the host system. This vulnerability is rated Medium (CVSS 6.8) due to its potential for high impact on confidentiality, integrity, and availability, though it requires physical or local access to the virtual machine. While there is no known active exploitation or public exploit code, the vulnerability has received significant community discussion and media coverage, indicating awareness within the cybersecurity community.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 10.0.0, < 10.1.6CPE matchmatch criteria | cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:* | ||
>= 11.0.0, < 11.0.3CPE matchmatch criteria | cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:* | ||
>= 14.0.0, < 14.1.7CPE matchmatch criteria | cpe:2.3:a:vmware:workstation:*:*:*:*:*:*:*:* | ||
>= 15.0.0, < 15.0.4CPE matchmatch criteria | cpe:2.3:a:vmware:workstation:*:*:*:*:*:*:*:* | ||
6.0CPE matchmatch criteria | cpe:2.3:o:vmware:esxi:6.0:-:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.