CVE-2024-22246 - Vulnerability Details - OpenCVE

VMware SD-WAN Edge contains an unauthenticated command injection vulnerability potentially leading to remote code execution.

A malicious actor with local access to the Edge Router UI during
activation may be able to perform a command injection attack that could
lead to full control of the router.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00493.

Key SSVC decision points have not yet been added.

Vendors	Products
Vmware	Sd-wan Edge

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors	Products
Vmware	Sd-wan Edge

Advisories

Source	ID	Title
EUVD	EUVD-2024-19815	VMware SD-WAN Edge contains an unauthenticated command injection vulnerability potentially leading to remote code execution. A malicious actor with local access to the Edge Router UI during activation may be able to perform a command injection attack that could lead to full control of the router.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.vmware.com/security/advisories/VMSA-2024-0008.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: vmware

Published: 2024-04-02T15:48:23.171Z

Updated: 2024-08-01T22:43:34.263Z

Reserved: 2024-01-08T18:43:03.535Z

Link: CVE-2024-22246

Vulnrichment

Updated: 2024-08-01T22:43:34.263Z

NVD

Status : Awaiting Analysis

Published: 2024-04-02T16:15:07.573

Modified: 2024-11-21T08:55:52.973

Link: CVE-2024-22246

Redhat

No data.

OpenCVE Enrichment

Updated: 2025-07-12T22:01:01Z

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-22246", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2024-01-08T18:43:03.535Z", "datePublished": "2024-04-02T15:48:23.171Z", "dateUpdated": "2024-08-01T22:43:34.263Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "VMware SD-WAN Edge", "vendor": "N/A", "versions": [{"status": "affected", "version": "VMware SD-WAN Edge 4.5.x, VMware SD-WAN Edge 5.x"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\nVMware SD-WAN Edge contains an unauthenticated command injection vulnerability potentially leading to remote code execution.\n\n\nA malicious actor with local access to the Edge Router UI during \nactivation may be able to perform a command injection attack that could \nlead to full control of the router. \n\n"}], "value": "VMware SD-WAN Edge contains an unauthenticated command injection vulnerability potentially leading to remote code execution.\n\nA malicious actor with local access to the Edge Router UI during \nactivation may be able to perform a command injection attack that could \nlead to full control of the router. \n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"description": "Unauthenticated Command Injection vulnerability in SD-WAN Edge ", "lang": "en"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2024-04-02T15:48:23.171Z"}, "references": [{"url": "https://www.vmware.com/security/advisories/VMSA-2024-0008.html"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-22246", "role": "CISA Coordinator", "options": [{"Exploitation": "None"}, {"Automatable": "No"}, {"Technical Impact": "Total"}], "version": "2.0.3", "timestamp": "2024-04-19T04:01:09.327516Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:vmware:sd-wan_edge:4.5.x:*:*:*:*:*:*:*"], "vendor": "vmware", "product": "sd-wan_edge", "versions": [{"status": "affected", "version": "4.5.x"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:vmware:sd-wan_edge:5.x:*:*:*:*:*:*:*"], "vendor": "vmware", "product": "sd-wan_edge", "versions": [{"status": "affected", "version": "5.x"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:52:41.265Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:43:34.263Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.vmware.com/security/advisories/VMSA-2024-0008.html", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.vmware.com/security/advisories/VMSA-2024-0008.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:43:34.263Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-22246", "role": "CISA Coordinator", "options": [{"Exploitation": "None"}, {"Automatable": "No"}, {"Technical Impact": "Total"}], "version": "2.0.3", "timestamp": "2024-04-19T04:01:09.327516Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:vmware:sd-wan_edge:4.5.x:*:*:*:*:*:*:*"], "vendor": "vmware", "product": "sd-wan_edge", "versions": [{"status": "affected", "version": "4.5.x"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:vmware:sd-wan_edge:5.x:*:*:*:*:*:*:*"], "vendor": "vmware", "product": "sd-wan_edge", "versions": [{"status": "affected", "version": "5.x"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-02T19:47:49.506Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "N/A", "product": "VMware SD-WAN Edge", "versions": [{"status": "affected", "version": "VMware SD-WAN Edge 4.5.x, VMware SD-WAN Edge 5.x"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.vmware.com/security/advisories/VMSA-2024-0008.html"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "VMware SD-WAN Edge contains an unauthenticated command injection vulnerability potentially leading to remote code execution.\n\nA malicious actor with local access to the Edge Router UI during \nactivation may be able to perform a command injection attack that could \nlead to full control of the router. \n\n", "supportingMedia": [{"type": "text/html", "value": "\nVMware SD-WAN Edge contains an unauthenticated command injection vulnerability potentially leading to remote code execution.\n\n\nA malicious actor with local access to the Edge Router UI during \nactivation may be able to perform a command injection attack that could \nlead to full control of the router. \n\n", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Unauthenticated Command Injection vulnerability in SD-WAN Edge "}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2024-04-02T15:48:23.171Z"}}}, "cveMetadata": {"cveId": "CVE-2024-22246", "state": "PUBLISHED", "dateUpdated": "2024-08-01T22:43:34.263Z", "dateReserved": "2024-01-08T18:43:03.535Z", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "datePublished": "2024-04-02T15:48:23.171Z", "assignerShortName": "vmware"}, "dataVersion": "5.1"}