8.1high
CVE-2018-6961KEVin critical feed1 exploitNuclei template
VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component.
Published 8 y ago · modified 4 mo ago · JSON
CVSS
8.1
v3.1 · CNA
CISA KEV
Yes
added 2022-03-25
EPSS
85.3%
percentile 100%
Public exploits
1
Exploit-DB · Nuclei check
Summary
VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component. This component is disabled by default and should not be enabled on untrusted networks. VeloCloud by VMware will be removing this service from the product in future releases. Successful exploitation of this issue could result in remote code execution.
Known exploited (CISA KEV)
- Added
- 4 y ago
- Due date
- 2022-04-15 (4 y ago)
- Ransomware use
- Unknown
- Required action
- Apply updates per vendor instructions.
- Vendor / product
- VMware / SD-WAN Edge
- CISA name
- VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability
CISA SSVC assessment
- Exploitation
- Active — exploited in the wild
- Automatable
- no
- Technical impact
- total
- Assessed
- 20 mo ago
Exploit prediction (EPSS)
85.34% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.
Exploits and detections
- Nuclei template VMware NSX SD-WAN Edge - Command Injection · nuclei detection template
- EDB-44959 VMware NSX SD-WAN Edge < 3.1.2 - Command Injection · webapps · 2018-07-02
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CISA ADP | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Affected products
- VMware NSX SD-WAN by VeloCloud
Classification
- Weakness
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
References
- securityfocus.com /bid/104185 · vdb-entry, x_refsource_BID, x_transferred
- exploit-db.com /exploits/44959/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
- securitytracker.com /id/1041210 · vdb-entry, x_refsource_SECTRACK, x_transferred
- vmware.com /security/advisories/VMSA-2018-0011.html · x_refsource_CONFIRM, x_transferred
- cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-6961 · government-resource
Sources
- CVE List: CVE-2018-6961
- NVD: CVE-2018-6961
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.