Search
Find a vulnerability
Search criteria
6 vulnerabilities found for sd-wan_edge by vmware
CVE-2024-22247 (GCVE-0-2024-22247)
Vulnerability from nvd – Published: 2024-04-02 15:49 – Updated: 2024-08-01 22:43
VLAI
EPSS
VEX
Summary
VMware SD-WAN Edge contains a missing authentication and protection mechanism vulnerability.
A malicious actor with physical access to the SD-WAN Edge appliance
during activation can potentially exploit this vulnerability to access
the BIOS configuration. In addition, the malicious actor may be able to
exploit the default boot priority configured.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-04-02 18:00 UTC
CWE
- Missing Authentication and Protection Mechanism vulnerability in SD-WAN Edge
- CWE-287 - Improper Authentication
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| N/A | VMware SD-WAN Edge |
Affected:
VMware SD-WAN Edge 4.5.x, VMware SD-WAN Edge 5.x
|
|
| vmware | sd-wan_edge |
Affected:
4.5.x
cpe:2.3:a:vmware:sd-wan_edge:4.5.x:*:*:*:*:*:*:* |
|
| vmware | sd-wan_edge |
Affected:
5.x
cpe:2.3:a:vmware:sd-wan_edge:5.x:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:vmware:sd-wan_edge:4.5.x:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "sd-wan_edge",
"vendor": "vmware",
"versions": [
{
"status": "affected",
"version": "4.5.x"
}
]
},
{
"cpes": [
"cpe:2.3:a:vmware:sd-wan_edge:5.x:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "sd-wan_edge",
"vendor": "vmware",
"versions": [
{
"status": "affected",
"version": "5.x"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-22247",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-02T18:00:39.986241Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:52:33.704Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T22:43:33.699Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.vmware.com/security/advisories/VMSA-2024-0008.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "VMware SD-WAN Edge",
"vendor": "N/A",
"versions": [
{
"status": "affected",
"version": "VMware SD-WAN Edge 4.5.x, VMware SD-WAN Edge 5.x"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\nVMware SD-WAN Edge contains a missing authentication and protection mechanism vulnerability.\n\n\nA malicious actor with physical access to the SD-WAN Edge appliance \nduring activation can potentially exploit this vulnerability to access \nthe BIOS configuration. In addition, the malicious actor may be able to \nexploit the default boot priority configured.\n\n"
}
],
"value": "VMware SD-WAN Edge contains a missing authentication and protection mechanism vulnerability.\n\nA malicious actor with physical access to the SD-WAN Edge appliance \nduring activation can potentially exploit this vulnerability to access \nthe BIOS configuration. In addition, the malicious actor may be able to \nexploit the default boot priority configured.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Missing Authentication and Protection Mechanism vulnerability in SD-WAN Edge",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-02T15:49:41.694Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://www.vmware.com/security/advisories/VMSA-2024-0008.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2024-22247",
"datePublished": "2024-04-02T15:49:41.694Z",
"dateReserved": "2024-01-08T18:43:03.535Z",
"dateUpdated": "2024-08-01T22:43:33.699Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-22246 (GCVE-0-2024-22246)
Vulnerability from nvd – Published: 2024-04-02 15:48 – Updated: 2025-12-16 18:13
VLAI
EPSS
VEX
Summary
VMware SD-WAN Edge contains an unauthenticated command injection vulnerability potentially leading to remote code execution.
A malicious actor with local access to the Edge Router UI during
activation may be able to perform a command injection attack that could
lead to full control of the router.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-04-19 04:01 UTC
CWE
- Unauthenticated Command Injection vulnerability in SD-WAN Edge
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| N/A | VMware SD-WAN Edge |
Affected:
VMware SD-WAN Edge 4.5.x, VMware SD-WAN Edge 5.x
|
|
| vmware | sd-wan_edge |
Affected:
4.5.x
cpe:2.3:a:vmware:sd-wan_edge:4.5.x:*:*:*:*:*:*:* |
|
| vmware | sd-wan_edge |
Affected:
5.x
cpe:2.3:a:vmware:sd-wan_edge:5.x:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:vmware:sd-wan_edge:4.5.x:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "sd-wan_edge",
"vendor": "vmware",
"versions": [
{
"status": "affected",
"version": "4.5.x"
}
]
},
{
"cpes": [
"cpe:2.3:a:vmware:sd-wan_edge:5.x:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "sd-wan_edge",
"vendor": "vmware",
"versions": [
{
"status": "affected",
"version": "5.x"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-22246",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-19T04:01:09.327516Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-16T18:13:22.955Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T22:43:34.263Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.vmware.com/security/advisories/VMSA-2024-0008.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "VMware SD-WAN Edge",
"vendor": "N/A",
"versions": [
{
"status": "affected",
"version": "VMware SD-WAN Edge 4.5.x, VMware SD-WAN Edge 5.x"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\nVMware SD-WAN Edge contains an unauthenticated command injection vulnerability potentially leading to remote code execution.\n\n\nA malicious actor with local access to the Edge Router UI during \nactivation may be able to perform a command injection attack that could \nlead to full control of the router. \n\n"
}
],
"value": "VMware SD-WAN Edge contains an unauthenticated command injection vulnerability potentially leading to remote code execution.\n\nA malicious actor with local access to the Edge Router UI during \nactivation may be able to perform a command injection attack that could \nlead to full control of the router. \n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Unauthenticated Command Injection vulnerability in SD-WAN Edge ",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-02T15:48:23.171Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://www.vmware.com/security/advisories/VMSA-2024-0008.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2024-22246",
"datePublished": "2024-04-02T15:48:23.171Z",
"dateReserved": "2024-01-08T18:43:03.535Z",
"dateUpdated": "2025-12-16T18:13:22.955Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-20899 (GCVE-0-2023-20899)
Vulnerability from nvd – Published: 2023-07-06 22:29 – Updated: 2024-11-14 20:51
VLAI
EPSS
VEX
Summary
VMware SD-WAN (Edge) contains a bypass authentication vulnerability. An unauthenticated attacker can download the Diagnostic bundle of the application under VMware SD-WAN Management.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-14 20:50 UTC
CWE
- Bypass Authentication
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | VMware SD-WAN (Edge) |
Affected:
VMware SD-WAN (Edge) 4.5.x, VMware SD-WAN (Edge) 5.x
|
|
| vmware | sd-wan_edge |
Affected:
4.5.x
Affected: 5.x cpe:2.3:h:vmware:sd-wan_edge:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T09:21:33.379Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.vmware.com/security/advisories/VMSA-2023-0015.html"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:h:vmware:sd-wan_edge:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "sd-wan_edge",
"vendor": "vmware",
"versions": [
{
"status": "affected",
"version": "4.5.x"
},
{
"status": "affected",
"version": "5.x"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-20899",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-14T20:50:51.513829Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-14T20:51:48.993Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "VMware SD-WAN (Edge)",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "VMware SD-WAN (Edge) 4.5.x, VMware SD-WAN (Edge) 5.x"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "VMware SD-WAN (Edge) contains a bypass authentication vulnerability. An unauthenticated attacker can download the Diagnostic bundle of the application under VMware SD-WAN Management."
}
],
"value": "VMware SD-WAN (Edge) contains a bypass authentication vulnerability. An unauthenticated attacker can download the Diagnostic bundle of the application under VMware SD-WAN Management."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Bypass Authentication",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-07-06T22:29:28.115Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://www.vmware.com/security/advisories/VMSA-2023-0015.html"
}
],
"source": {
"advisory": "VMSA-2023-0015",
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2023-20899",
"datePublished": "2023-07-06T22:29:19.852Z",
"dateReserved": "2022-11-01T15:41:50.396Z",
"dateUpdated": "2024-11-14T20:51:48.993Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-22247 (GCVE-0-2024-22247)
Vulnerability from cvelistv5 – Published: 2024-04-02 15:49 – Updated: 2024-08-01 22:43
VLAI
EPSS
VEX
Summary
VMware SD-WAN Edge contains a missing authentication and protection mechanism vulnerability.
A malicious actor with physical access to the SD-WAN Edge appliance
during activation can potentially exploit this vulnerability to access
the BIOS configuration. In addition, the malicious actor may be able to
exploit the default boot priority configured.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-04-02 18:00 UTC
CWE
- Missing Authentication and Protection Mechanism vulnerability in SD-WAN Edge
- CWE-287 - Improper Authentication
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| N/A | VMware SD-WAN Edge |
Affected:
VMware SD-WAN Edge 4.5.x, VMware SD-WAN Edge 5.x
|
|
| vmware | sd-wan_edge |
Affected:
4.5.x
cpe:2.3:a:vmware:sd-wan_edge:4.5.x:*:*:*:*:*:*:* |
|
| vmware | sd-wan_edge |
Affected:
5.x
cpe:2.3:a:vmware:sd-wan_edge:5.x:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:vmware:sd-wan_edge:4.5.x:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "sd-wan_edge",
"vendor": "vmware",
"versions": [
{
"status": "affected",
"version": "4.5.x"
}
]
},
{
"cpes": [
"cpe:2.3:a:vmware:sd-wan_edge:5.x:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "sd-wan_edge",
"vendor": "vmware",
"versions": [
{
"status": "affected",
"version": "5.x"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-22247",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-02T18:00:39.986241Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:52:33.704Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T22:43:33.699Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.vmware.com/security/advisories/VMSA-2024-0008.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "VMware SD-WAN Edge",
"vendor": "N/A",
"versions": [
{
"status": "affected",
"version": "VMware SD-WAN Edge 4.5.x, VMware SD-WAN Edge 5.x"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\nVMware SD-WAN Edge contains a missing authentication and protection mechanism vulnerability.\n\n\nA malicious actor with physical access to the SD-WAN Edge appliance \nduring activation can potentially exploit this vulnerability to access \nthe BIOS configuration. In addition, the malicious actor may be able to \nexploit the default boot priority configured.\n\n"
}
],
"value": "VMware SD-WAN Edge contains a missing authentication and protection mechanism vulnerability.\n\nA malicious actor with physical access to the SD-WAN Edge appliance \nduring activation can potentially exploit this vulnerability to access \nthe BIOS configuration. In addition, the malicious actor may be able to \nexploit the default boot priority configured.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Missing Authentication and Protection Mechanism vulnerability in SD-WAN Edge",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-02T15:49:41.694Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://www.vmware.com/security/advisories/VMSA-2024-0008.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2024-22247",
"datePublished": "2024-04-02T15:49:41.694Z",
"dateReserved": "2024-01-08T18:43:03.535Z",
"dateUpdated": "2024-08-01T22:43:33.699Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-22246 (GCVE-0-2024-22246)
Vulnerability from cvelistv5 – Published: 2024-04-02 15:48 – Updated: 2025-12-16 18:13
VLAI
EPSS
VEX
Summary
VMware SD-WAN Edge contains an unauthenticated command injection vulnerability potentially leading to remote code execution.
A malicious actor with local access to the Edge Router UI during
activation may be able to perform a command injection attack that could
lead to full control of the router.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-04-19 04:01 UTC
CWE
- Unauthenticated Command Injection vulnerability in SD-WAN Edge
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| N/A | VMware SD-WAN Edge |
Affected:
VMware SD-WAN Edge 4.5.x, VMware SD-WAN Edge 5.x
|
|
| vmware | sd-wan_edge |
Affected:
4.5.x
cpe:2.3:a:vmware:sd-wan_edge:4.5.x:*:*:*:*:*:*:* |
|
| vmware | sd-wan_edge |
Affected:
5.x
cpe:2.3:a:vmware:sd-wan_edge:5.x:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:vmware:sd-wan_edge:4.5.x:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "sd-wan_edge",
"vendor": "vmware",
"versions": [
{
"status": "affected",
"version": "4.5.x"
}
]
},
{
"cpes": [
"cpe:2.3:a:vmware:sd-wan_edge:5.x:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "sd-wan_edge",
"vendor": "vmware",
"versions": [
{
"status": "affected",
"version": "5.x"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-22246",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-19T04:01:09.327516Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-16T18:13:22.955Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T22:43:34.263Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.vmware.com/security/advisories/VMSA-2024-0008.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "VMware SD-WAN Edge",
"vendor": "N/A",
"versions": [
{
"status": "affected",
"version": "VMware SD-WAN Edge 4.5.x, VMware SD-WAN Edge 5.x"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\nVMware SD-WAN Edge contains an unauthenticated command injection vulnerability potentially leading to remote code execution.\n\n\nA malicious actor with local access to the Edge Router UI during \nactivation may be able to perform a command injection attack that could \nlead to full control of the router. \n\n"
}
],
"value": "VMware SD-WAN Edge contains an unauthenticated command injection vulnerability potentially leading to remote code execution.\n\nA malicious actor with local access to the Edge Router UI during \nactivation may be able to perform a command injection attack that could \nlead to full control of the router. \n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Unauthenticated Command Injection vulnerability in SD-WAN Edge ",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-02T15:48:23.171Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://www.vmware.com/security/advisories/VMSA-2024-0008.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2024-22246",
"datePublished": "2024-04-02T15:48:23.171Z",
"dateReserved": "2024-01-08T18:43:03.535Z",
"dateUpdated": "2025-12-16T18:13:22.955Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-20899 (GCVE-0-2023-20899)
Vulnerability from cvelistv5 – Published: 2023-07-06 22:29 – Updated: 2024-11-14 20:51
VLAI
EPSS
VEX
Summary
VMware SD-WAN (Edge) contains a bypass authentication vulnerability. An unauthenticated attacker can download the Diagnostic bundle of the application under VMware SD-WAN Management.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-14 20:50 UTC
CWE
- Bypass Authentication
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | VMware SD-WAN (Edge) |
Affected:
VMware SD-WAN (Edge) 4.5.x, VMware SD-WAN (Edge) 5.x
|
|
| vmware | sd-wan_edge |
Affected:
4.5.x
Affected: 5.x cpe:2.3:h:vmware:sd-wan_edge:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T09:21:33.379Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.vmware.com/security/advisories/VMSA-2023-0015.html"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:h:vmware:sd-wan_edge:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "sd-wan_edge",
"vendor": "vmware",
"versions": [
{
"status": "affected",
"version": "4.5.x"
},
{
"status": "affected",
"version": "5.x"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-20899",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-14T20:50:51.513829Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-14T20:51:48.993Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "VMware SD-WAN (Edge)",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "VMware SD-WAN (Edge) 4.5.x, VMware SD-WAN (Edge) 5.x"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "VMware SD-WAN (Edge) contains a bypass authentication vulnerability. An unauthenticated attacker can download the Diagnostic bundle of the application under VMware SD-WAN Management."
}
],
"value": "VMware SD-WAN (Edge) contains a bypass authentication vulnerability. An unauthenticated attacker can download the Diagnostic bundle of the application under VMware SD-WAN Management."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Bypass Authentication",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-07-06T22:29:28.115Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://www.vmware.com/security/advisories/VMSA-2023-0015.html"
}
],
"source": {
"advisory": "VMSA-2023-0015",
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2023-20899",
"datePublished": "2023-07-06T22:29:19.852Z",
"dateReserved": "2022-11-01T15:41:50.396Z",
"dateUpdated": "2024-11-14T20:51:48.993Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}