CVE-2018-6961
VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability
Description
CVE-2018-6961 is a critical command injection vulnerability in VMware SD-WAN Edge by VeloCloud that allows an unauthenticated attacker to execute arbitrary commands on the underlying operating system. The vulnerability exists in the web-based management interface, which fails to properly validate user-supplied input, enabling OS command injection through crafted HTTP requests. CISA has added CVE-2018-6961 to the Known Exploited Vulnerabilities catalog due to confirmed active exploitation. With an EPSS score of 93.6% (99.8th percentile), this vulnerability represents a critical threat to organizations deploying VMware SD-WAN Edge appliances.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| vmware | nsx sd-wan by velocloud | < 3.1.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/104185(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1041210(Broken Link, Third Party Advisory, VDB Entry)
- http://www.vmware.com/security/advisories/VMSA-2018-0011.html(Vendor Advisory)
- https://www.exploit-db.com/exploits/44959/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-6961(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-78 describes a weakness where software constructs operating system commands using externally-influenced input without properly neutralizing special elements that could modify the intended command. In CVE-2018-6961, the VMware SD-WAN Edge web management interface fails to adequately sanitize user input, allowing an unauthenticated attacker to inject arbitrary OS commands that are executed on the underlying system.
Learn more: CWE-78 — OS Command Injection
Impact Analysis
CVE-2018-6961 enables unauthenticated remote code execution on VMware SD-WAN Edge appliances, which serve as critical networking infrastructure components in enterprise software-defined WAN deployments. Successful exploitation grants attackers the ability to execute arbitrary commands on the underlying operating system, potentially leading to complete device compromise including interception and manipulation of all network traffic routed through the SD-WAN edge device. Since SD-WAN Edge appliances connect branch offices to corporate networks and cloud services, compromise of these devices can provide attackers with a strategically valuable position for surveillance, data exfiltration, and lateral movement across the entire SD-WAN fabric. The EPSS score of 93.6% (99.8th percentile) confirms extremely high exploitation probability.
Exploit Maturity
CVE-2018-6961 is actively exploited in the wild, as confirmed by its inclusion in the CISA Known Exploited Vulnerabilities catalog. The vulnerability requires no authentication and can be exploited through the web management interface, making it accessible to automated scanning and exploitation tools. The EPSS score of 93.6% (99.8th percentile) reflects near-certain exploitation activity. SD-WAN infrastructure has become an increasingly attractive target for advanced threat actors due to its strategic position in enterprise network architectures.
Remediation
- Apply VMware security patches immediately by updating VMware SD-WAN Edge (VeloCloud) to the version specified in VMware Security Advisory VMSA-2018-0011, as required by the CISA KEV directive.
- Restrict access to the SD-WAN Edge web management interface to trusted management networks only, ensuring it is not accessible from untrusted networks or the public internet.
- Review system logs on all SD-WAN Edge appliances for indicators of compromise, including unexpected command execution, unauthorized configuration changes, or anomalous network traffic patterns.
- Implement network monitoring to detect unusual traffic originating from or destined to SD-WAN Edge management interfaces, and deploy intrusion detection rules specific to this vulnerability.
- As a long-term measure, implement centralized management and monitoring for all SD-WAN Edge devices, enforce strict access controls on management interfaces, and maintain a regular patching cadence for all SD-WAN infrastructure components.
Technical Details
CVE-2018-6961 is an OS command injection vulnerability (CWE-78) in the web-based management interface of VMware SD-WAN Edge by VeloCloud. The vulnerability exists because user-supplied input is passed to operating system commands without adequate validation or sanitization. An unauthenticated remote attacker can exploit this flaw by sending specially crafted HTTP requests to the management interface that include shell metacharacters or command sequences in request parameters. These injected commands are then executed by the underlying operating system with the privileges of the web application process. The attack does not require authentication, making it exploitable by any attacker who can reach the management interface over the network. VMware SD-WAN Edge appliances are deployed at branch office locations and connect to the SD-WAN fabric, making them distributed targets across enterprise network infrastructures.
Frequently Asked Questions
Is CVE-2018-6961 being actively exploited?
Yes, CVE-2018-6961 is actively exploited in the wild and is listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 93.6% (99.8th percentile) confirms extremely high exploitation activity. Any VMware SD-WAN Edge appliance with an exposed web management interface running a vulnerable version should be considered at immediate risk.
What products are affected by CVE-2018-6961?
CVE-2018-6961 affects VMware SD-WAN Edge by VeloCloud. The vulnerability is in the web-based management interface of the SD-WAN Edge appliance. Consult VMware Security Advisory VMSA-2018-0011 for specific affected version numbers.
How do I fix CVE-2018-6961?
Apply the security update from VMware as described in VMSA-2018-0011. Restrict access to the SD-WAN Edge web management interface to trusted management networks only. If immediate patching is not possible, block all external access to the management interface as a temporary mitigation.
How severe is CVE-2018-6961?
CVE-2018-6961 is rated CRITICAL as it enables unauthenticated remote code execution on SD-WAN Edge networking infrastructure. The EPSS score of 93.6% (99.8th percentile) indicates near-certain exploitation. Compromise of SD-WAN Edge devices gives attackers access to all traffic flowing through the device and a pivot point into the broader enterprise network.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.