{"id":"CVE-2018-6961","kind":"vulnerability","aliases":["CVE-2018-6961"],"related":[],"title":"VMware SD-WAN Edge: VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability","description":"VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component. This component is disabled by default and should not be enabled on untrusted networks. VeloCloud by VMware will be removing this service from the product in future releases. Successful exploitation of this issue could result in remote code execution.","summary":"VMware SD-WAN Edge (VeloCloud) has a command injection flaw in its local web UI. An attacker who can reach the UI can inject operating system commands and run code on the appliance.","severity":"critical","cvss":8.1,"epss":0.85342,"exploited":true,"exploited_at":"2022-03-25T00:00:00+00:00","products":[{"name":"VMware SD-WAN Edge","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","network-appliance","sd-wan","velocloud","vmware"],"not_affected_if":["not-using-sd-wan-edge"],"how_to_check":null,"fix":"Apply the vendor updates per VMware instructions; the fixed version is unknown from the sources.","status":"open","published_at":"2018-06-11T22:29:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:20:08+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:20:08Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor updates per VMware instructions; the fixed version is unknown from the sources.","reach":"unknown","impact":"high","summary":"VMware SD-WAN Edge (VeloCloud) has a command injection flaw in its local web UI. An attacker who can reach the UI can inject operating system commands and run code on the appliance.","category":"infrastructure","who_cares":["vmware","sd-wan","velocloud","network-appliance"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs commands on the SD-WAN edge appliance as remote code execution.","analyst_note":"CISA KEV lists this as exploited with EPSS 0.853; find the vendor advisory and affected/fixed versions, and whether the web UI is exposed to the internet by default.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-using-sd-wan-edge"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000466,"input_tokens":2852,"output_tokens":361,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"CISA KEV lists this as exploited with EPSS 0.853; find the vendor advisory and affected/fixed versions, and whether the web UI is exposed to the internet by default.","search":"'-2018':17A,20A '-6961':18A,21A '3.1.0':82C 'applianc':31B,70B 'attack':54B 'code':67B,131C 'command':13A,45B,64B,85C 'compon':93C,95C 'contain':83C 'could':127C 'cve':16A,19A 'default':99C 'disabl':97C 'edg':5A,10A,41B,76C 'edge':26A 'enabl':104C 'execut':132C 'exploit':27B,123C 'flaw':47B 'futur':120C 'infrastructur':28B 'inject':14A,46B,61B,86C 'issu':126C 'local':50B,90C 'network':30B,107C 'network-appli':29B 'nsx':72C 'oper':62B 'prior':79C 'product':118C 'reach':57B 'releas':121C 'remot':130C 'remov':113C 'result':128C 'run':66B 'sd':3A,8A,24A,33B,39B,74C 'sd-wan':2A,7A,23A,32B,38B,73C 'servic':115C 'success':122C 'system':63B 'ui':52B,59B,92C 'untrust':106C 'velocloud':12A,35B,42B,78C,108C 'version':81C 'vmware':1A,6A,22A,36B,37B,71C,110C 'vulner':15A,87C 'wan':4A,9A,25A,34B,40B,75C 'web':51B,91C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2018-06-11T22:29:00+00:00","kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2018-6961","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-6961","severity":null,"published_at":"2022-03-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T16:39:48+00:00","note":null},{"source":"epss","external_id":"CVE-2018-6961","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-6961","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2018-6961","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6961","severity":null,"published_at":"2018-06-11T22:29:00+00:00","modified_at":"2026-06-17T02:02:31+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}