CVE-2018-6961

VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component. This component is disabled by default and should not be enabled on untrusted networks. VeloCloud by VMware will be removing this service from the product in future releases. Successful exploitation of this issue could result in remote code execution.

• CWE-78
• CWE-78

• http://www.securityfocus.com/bid/104185Broken Link, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1041210Broken Link, Third Party Advisory, VDB Entry
• http://www.vmware.com/security/advisories/VMSA-2018-0011.htmlVendor Advisory
• https://www.exploit-db.com/exploits/44959/Exploit, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/104185Broken Link, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1041210Broken Link, Third Party Advisory, VDB Entry
• http://www.vmware.com/security/advisories/VMSA-2018-0011.htmlVendor Advisory
• https://www.exploit-db.com/exploits/44959/Exploit, Third Party Advisory, VDB Entry
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-6961US Government Resource

Published

Jun 11, 2018

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-6953In CCN-lite 2, the Parser of NDNTLV does not verify whether …
• CVE-2018-6954systemd-tmpfiles in systemd through 237 mishandles symlinks …7.8
• CVE-2018-6957VMware Workstation (14.x before 14.1.1, 12.x) and Fusion (10…
• CVE-2018-6958VMware vRealize Automation (vRA) prior to 7.3.1 contains a v…
• CVE-2018-6959VMware vRealize Automation (vRA) prior to 7.4.0 contains a v…
• CVE-2018-6960VMware Horizon DaaS (7.x before 8.0.0) contains a broken aut…
• CVE-2018-6962VMware Fusion (10.x before 10.1.2) contains a signature bypa…
• CVE-2018-6963VMware Workstation (14.x before 14.1.2) and Fusion (10.x bef…
• CVE-2018-6964VMware Horizon Client for Linux (4.x before 4.8.0 and prior)…
• CVE-2018-6965VMware ESXi (6.7 before ESXi670-201806401-BG), Workstation (…8.1
• CVE-2018-6966VMware ESXi (6.7 before ESXi670-201806401-BG), Workstation (…8.1
• CVE-2018-6967VMware ESXi (6.7 before ESXi670-201806401-BG), Workstation (…8.1