Vulnerability · Published Apr 2, 2024 · Assigned by vmware
CVE-2024-22247
Medium 4.8
In plain English
A medium-severity improper authentication in VMware SD-WAN Edge. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Severity (CVSS 3.1)4.8Medium
Exploit odds (30 days)0.2%top 88.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
VMware SD-WAN Edge contains a missing authentication and protection mechanism vulnerability. A malicious actor with physical access to the SD-WAN Edge appliance during activation can potentially exploit this vulnerability to access the BIOS configuration. In addition, the malicious actor may be able to exploit the default boot priority configured.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| N/A | VMware SD-WAN Edge | VMware SD-WAN Edge 4.5.x, VMware SD-WAN Edge 5.x |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H