CVE-2018-6961

What is VMware SD-WAN Edge?

VMware SD-WAN Edge (originally developed by VeloCloud, acquired by VMware in 2017) is a branch-office appliance that provides software-defined WAN connectivity, routing traffic across broadband, LTE, and MPLS links. Edge devices typically sit at the perimeter of a branch network and expose a local web-based management UI for configuration and diagnostics — a natural target since compromising the appliance can expose or redirect all WAN traffic for a site.

Overview

CVE-2018-6961 is a command injection vulnerability in the local web UI of VMware SD-WAN Edge appliances. An attacker able to reach the management interface can inject operating system commands that are executed by the underlying appliance, leading to full remote code execution on the device. The vulnerability carries a CVSS score of 8.1 (High) with high attack complexity, reflecting that successful exploitation likely depends on specific conditions in how the UI processes input, but it requires no authentication and no user interaction once those conditions are met.

Technical Details

The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command — OS command injection): one or more fields or parameters handled by the SD-WAN Edge web UI are passed to a shell or system call without adequate sanitization, allowing an attacker to append additional shell metacharacters and commands. Because the Edge device runs as the network gateway for a branch site, code execution on the appliance can allow an attacker to intercept, redirect, or manipulate all traffic passing through it.

Discovery

The issue was identified and addressed by VMware through its standard security response process for SD-WAN Edge/VeloCloud products.

Exploitation Context

CISA added CVE-2018-6961 to the KEV catalog in March 2022, indicating confirmed exploitation in the wild. SD-WAN and other network edge appliances have become an increasingly common target for both opportunistic and targeted actors because compromising them provides a durable foothold with visibility into all traffic traversing the branch office.

Remediation

1. Upgrade VMware SD-WAN Edge appliances to a patched software version per VMware's guidance.
2. Restrict access to the local web management UI to trusted management networks only — never expose it directly to the internet.
3. Enforce strong, unique credentials and, where supported, multi-factor authentication for administrative access to Edge devices.
4. Monitor Edge device logs and configuration state for unexpected changes that could indicate command injection had occurred.
5. Segment branch network management traffic from general user traffic to limit the impact of a compromised Edge appliance.