CVE-2018-6961

8.1 highKEVEPSS 85%

VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component. This component is disabled by default and should not be enabled on untrusted networks. VeloCloud by VMware will be removing this service from the product in future releases. Successful exploitation of this issue could result in remote code execution.

Severity

CVSS 3.1

8.1 high

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 85% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CISA KEV: listed 2022-03-25, due 2022-04-15
CWE: CWE-78
Published: 2018-06-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

vmware:nsx_sd-wan_by_velocloud

References

http://www.securityfocus.com/bid/104185
http://www.securitytracker.com/id/1041210
http://www.vmware.com/security/advisories/VMSA-2018-0011.html
https://www.exploit-db.com/exploits/44959/
http://www.securityfocus.com/bid/104185

Check your stack JSON