CVE-2018-6961
VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.
Required action
Apply updates per vendor instructions.
CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2018-6961
Description
VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component. This component is disabled by default and should not be enabled on untrusted networks. VeloCloud by VMware will be removing this service from the product in future releases. Successful exploitation of this issue could result in remote code execution.
Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HAffected Products
| Vendor | Product | Affected versions |
|---|---|---|
| VMware | NSX SD-WAN by VeloCloud | prior to version 3.1.0 |
References
4 LinksRecord Details
More from VMware
VMware vCenter Server Improper Input Validation Vulnerability
VMware vCenter Server File Upload Vulnerability
VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability
VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.