Live › vulnerability › CVE-2018-6961
Go to dashboardVMware SD-WAN Edge (VeloCloud) has a command injection flaw in its local web UI. An attacker who can reach the UI can inject operating system commands and run code on the appliance.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| VMware SD-WAN Edge | vendor | – | – |
Unknown from the sources. In the analyst’s queue.
Apply the vendor updates per VMware instructions; the fixed version is unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component. This component is disabled by default and should not be enabled on untrusted networks. VeloCloud by VMware will be removing this service from the product in future releases. Successful exploitation of this issue could result in remote code execution.
This page as .md · .json · in your agent: get_signal("CVE-2018-6961")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.