External risk intelligence

VMware NSX SD-WAN Command Injection Vulnerability.

CVE advisoryKnown Exploit

CVE-2018-6961

VMware NSX SD-WAN Edge has a command injection vulnerability in its local web UI, which could allow remote code execution. This component is disabled by default, limiting realistic business risk unless intentionally enabled on untrusted networks. Successful exploitation could impact systems and data.

2Halo Surface Signal

OS Command Injection

Vmware Nsx Sd Wan By Velocloud

before 3.1.0

External exposure likelihood

Halo Surface Signal score for CVE-2018-6961

The vulnerability exists in a local web UI component that is disabled by default and specifically advised against being enabled on untrusted networks. While it is network-reachable if manually configured, public internet exposure is uncommon in standard deployment practices.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Horizon Alert

Summary of the vulnerability and why it matters

VMware NSX SD-WAN Edge by VeloCloud contains a flaw in its local web UI component. This weakness allows attackers to execute arbitrary code remotely on affected systems. The impact could include unauthorized access to and control over business systems and data.

  • Vulnerable web UI component
  • Command injection flaw
  • Remote code execution

Attack Path

How an attacker could exploit the issue

A command injection vulnerability exists in the local web UI component of VMware NSX SD-WAN Edge. This component is disabled by default, and organizations should not enable it on untrusted networks. If an attacker gains access, they could execute commands remotely, potentially leading to a compromise of the affected system.

  • Internet-accessible web UI enabled.
  • Attacker injects commands.
  • Remote code execution results.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability impacts VMware NSX SD-WAN Edge products before version 3.1.0, specifically concerning a command injection flaw within its local web UI. Successful exploitation could enable remote code execution, allowing attackers to compromise systems. The component is disabled by default and not intended for use on untrusted networks, limiting its exposure. Organizations using affected versions should consider the implications if this component has been enabled.

  • Attackers require moderate skill.
  • The component must be enabled.
  • Business risk and urgency are moderate.

Priority actions

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in VMware NSX SD-WAN Edge by VeloCloud could allow for remote code execution if exploited. The affected component, a local web UI, is disabled by default and should not be enabled on untrusted networks. The vendor plans to remove this service in future releases. Organizations should take steps to understand their exposure and mitigate risk.

  • Identify affected assets.
  • Reduce exposure or isolate risk.
  • Fix, verify, and monitor.

Frequently asked questions

What is VMware NSX SD-WAN Edge and what is it used for?

VMware NSX SD-WAN Edge is a component of VMware's Software-Defined Wide Area Network (SD-WAN) solution. It's deployed at branch offices, data centers, or in the cloud to provide secure and optimized connectivity to applications and data. It helps manage and optimize traffic across various network links and locations, ensuring reliable and efficient access to cloud and on-premises resources.

What is the CVE-2018-6961 vulnerability and what weakness class does it relate to?

CVE-2018-6961 is a command injection vulnerability. This type of weakness, classified as CWE-78, occurs when an application uses untrusted input to construct operating system commands without properly sanitizing special characters. This can allow an attacker to execute arbitrary commands on the affected system, potentially leading to remote code execution.

What are the preconditions for an attacker to exploit this vulnerability?

To exploit this vulnerability, an attacker would need the local web UI component of VMware NSX SD-WAN Edge to be enabled. This component is disabled by default and is not intended for use on untrusted networks. The vulnerability does not trigger if the web UI is disabled or if the system is running version 3.1.0 or later.

Who should be concerned about this vulnerability based on Halo Surface Signal data?

The Halo Surface Signal indicates this vulnerability is 'Unlikely' to be exposed to the public internet in typical deployments. This is because the vulnerable component (local web UI) is disabled by default and advised against enabling on untrusted networks. Organizations that have specifically enabled this component on internet-facing systems would have a higher level of concern.

What are the first steps for managing this technology after learning about the vulnerability?

The primary step is to ensure that affected VMware NSX SD-WAN Edge devices are updated to version 3.1.0 or later, as this mitigates the vulnerability. If updating is not immediately possible, verify that the local web UI component is disabled. VMware plans to remove this component in future releases.

References

Sources and related resources

Primary sources: NVD, CVE.org, CISA KEV.

NVDPublished Modified