CVE-2018-6961highunder attackCWE-78

CVE-2018-6961: high-severity vulnerability in VMware NSX SD-WAN by VeloCloud

Published · Updated

Follow this CVE+ Monitor SD-WAN Edge+ Monitor NSX SD-WAN by VeloCloud

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8.1epss 85%
from disclosure to weapon21 days
Published on NVDJun 11
1st PoC+21d
CISA KEV+1383d
Action required by CISAfederal deadline: 2022-04-15

Apply updates per vendor instructions.

In short

VMware NSX SD-WAN Edge versions before 3.1.0 have a command injection flaw in a local web interface that allows attackers to run arbitrary code on the device. This happens when the web UI is enabled, which is off by default but can be manually turned on.

Technical detail

A command injection vulnerability exists in the local web UI component of VMware NSX SD-WAN Edge prior to 3.1.0 (CWE-78). An attacker with network access to the enabled web interface can inject OS commands that execute with device privileges, leading to remote code execution. The component is disabled by default, reducing exposure but allowing RCE when administratively enabled.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component. This component is disabled by default and should not be enabled on untrusted networks. VeloCloud by VMware will be removing this service from the product in future releases. Successful exploitation of this issue could result in remote code execution.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
VMware · NSX SD-WAN by VeloCloud
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.