VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component.

published 2018-06-11 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-18705

cvss: 8.1; version 3.1, CNA
cisa kev: Exploited; added 2022-03-25
epss: 85.5%; EPSS 85.5% chance of exploitation in 30 days, percentile 99.7%
public exploits: 1; Exploit-DB, plus a Nuclei check

VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component. This component is disabled by default and should not be enabled on untrusted networks. VeloCloud by VMware will be removing this service from the product in future releases. Successful exploitation of this issue could result in remote code execution.

Patch / fix

cisa required action Apply updates per vendor instructions.

fixed in 1

vmware nsx_sd-wan_by_velocloud 3.1.0

Timeline

2018-06-11 Published
2018-07-02 First public exploit (EDB-44959)
2022-03-25 Added to CISA KEV
2022-04-15 CISA patch deadline
2025-02-07 CISA SSVC: exploitation active

Known exploited

Added: 4 y ago (2022-03-25)
Patch by: 2022-04-15 (4 y ago)
Ransomware: Not known
Required action: Apply updates per vendor instructions.
Vendor, product: VMware, SD-WAN Edge
CISA name: VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: no
Technical impact: total
Assessed: 21 mo ago (2025-02-07)

Exploit prediction

85.46% chance of exploitation in the next 30 days, higher than 99.7% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

EDB-44959 VMware NSX SD-WAN Edge < 3.1.2 - Command Injection webapps, 2018-07-02
Nuclei template VMware NSX SD-WAN Edge - Command Injection nuclei detection template

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA	3.1	8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	6.8	AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

VMware NSX SD-WAN by VeloCloud

Classification

Weakness

CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

exploit-db.com /exploits/44959/
exploit, third-party-advisory, vdb-entry
vmware.com /security/advisories/VMSA-2018-0011.html
vendor-advisory
securityfocus.com /bid/104185
vdb-entry, broken-link, third-party-advisory
securitytracker.com /id/1041210
vdb-entry, broken-link, third-party-advisory
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-6961
government-resource, us-government-resource

Sources

CVE List CVE-2018-6961
NVD CVE-2018-6961

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary