Log in Start free

Actively exploited · Published Jun 11, 2018 · Assigned by vmware

CVE-2018-6961

High 8.1 Exploited

In plain English

A high-severity OS command injection in NSX SD-WAN by VeloCloud from VMware. Attackers are actively exploiting it in the wild (listed by CISA on March 25, 2022). The chance it is exploited in the next 30 days is estimated at 85.3% (higher than 99.7% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Apply updates per vendor instructions.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)85.3%top 0.3% of all CVEs
Exploited in the wildYesCISA KEV since Mar 25, 2022
Attack tooling2Nuclei, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Apr 15, 2022.

Official description

VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component. This component is disabled by default and should not be enabled on untrusted networks. VeloCloud by VMware will be removing this service from the product in future releases. Successful exploitation of this issue could result in remote code execution.

Affected products (as reported)

VendorProductVersions
VMware NSX SD-WAN by VeloCloud prior to version 3.1.0

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References