CVE-2018-6961 is a by velocloud command injection vulnerability in VMware SD-WAN Edge. CISA added it to the Known Exploited Vulnerabilities catalogue on 25 March 2022, which means attackers have used it in real attacks. VMware SD-WAN Edge by VeloCloud contains a command injection vulnerability in the local web UI component.
Why command injection in an SD-WAN edge matters
Command injection is dangerous because it can turn a web-facing management component into an execution path on the underlying appliance. On an SD-WAN edge, that can move the issue beyond interface abuse into device compromise, configuration tampering, and possible pivoting into the connected network.
Because VMware SD-WAN Edge exposes a local web UI component, the risk is not just that a request is malformed, but that attacker-controlled input may be interpreted by the system as a shell command. For a broader view of how injection flaws are classified and abused, the OWASP Top 10 remains a useful baseline reference, and NHIMG’s Web Application Attacks Guide covers command injection alongside related web exploit patterns.
How attackers typically abuse command injection in appliance software
In appliance and edge-device software, command injection often appears where web inputs, request parameters, or admin functions are passed unsafely to operating-system commands. The attack goal is usually to gain code execution, collect secrets, alter settings, or establish persistence with the trust granted to the management plane.
This is especially sensitive in edge products because they often sit at a network boundary, manage traffic, and have privileged access to routing or policy settings. Once an attacker can execute commands, the compromise can extend well beyond the original web interface. NHIMG’s Vulnerability Management Guide is useful for understanding how exploited flaws like KEV-listed CVEs should be prioritised, while the CVE Program is the authoritative source for identifier records and vulnerability naming.
Exposure checks and remediation priorities
Organisations should first determine whether any VMware SD-WAN Edge systems are present, whether the vulnerable web UI is reachable, and whether the device is internet-exposed or reachable from user or admin networks. Asset inventory matters here because unmanaged edge devices are often missed until they are already in service.
Once exposure is confirmed, remediation should follow vendor guidance and the CISA KEV catalogue entry for this CVE, because KEV inclusion signals known exploitation in the wild. If patching or upgrading cannot happen immediately, compensating controls usually include restricting management-plane access, removing unnecessary exposure, tightening administrative trust paths, and monitoring for suspicious requests against the web UI. For a broader control perspective, NIST SP 800-53 Rev 5 Security and Privacy Controls provides the control families typically used to govern access, logging, and system integrity on managed devices.
Detection and compromise review after suspected exploitation
When command injection is suspected, defenders should review device logs, web access traces, and any available command or system telemetry for unusual parameter patterns, unexpected process launches, configuration changes, or outbound connections from the edge appliance. Because the attack path can be short, absence of a long dwell time should not be assumed to mean absence of compromise.
Post-exploitation review should also consider whether the device exposed credentials, session material, or administrative state that could be reused elsewhere. If the appliance was used as a control point for network access, compromise review should extend to adjacent systems and management accounts. The State of NHI & AI Agent Breach Report 2026 is useful for understanding how stolen access material and privileged control paths are commonly abused after an initial foothold.
Risk and Threat Considerations
For edge and perimeter devices, command injection is especially risky because a single weakness can expose the management plane, the routing plane, and sometimes the wider internal network. The danger is amplified when the device is internet-reachable, lightly monitored, or used as a trusted administrative gateway.
Failure mechanism: Attacker-controlled input reaches an underlying command interpreter or shell context, allowing arbitrary command execution instead of ordinary request handling.
Impact: An attacker may be able to change configuration, steal secrets, persist on the appliance, or use the device as a launch point for lateral movement and further intrusion.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP ASVS, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP ASVS | V15 — Secure Coding and Architecture | Command injection is a secure-coding and architecture failure in input handling. |
| Recommendation — Eliminate shell execution paths for untrusted input and refactor the affected handling logic. | ||
| NIST SP 800-53 Rev 5 | SI-10 — Information Input Validation | This CVE is an input-validation failure leading to command execution. |
| AU-6 — Audit Record Review, Analysis, and Reporting | Detection depends on reviewing device and management-plane logs after exploitation. | |
| AC-6 — Least Privilege | Compromised admin interfaces should not have broad privilege on the device or network. | |
| Recommendation — Validate and constrain all web UI input before it reaches system commands. Review appliance audit and web logs for abnormal requests and command activity. Restrict management access and administrative privilege to the minimum required. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Logging and review are central to detecting exploitation and confirming impact. |
| Recommendation — Centralise and review appliance logs to detect suspicious management-plane activity. | ||
Practitioner Guidance
Why practitioners should care: For a device like SD-WAN edge software, the operational issue is not only patching a CVE, but protecting a high-trust control point that can affect many connected systems at once. Treat the management interface as privileged infrastructure, not as a routine admin page.
What to watch for: Prioritise any exposed instance, any appliance with administrative access from broad networks, and any device that shows unexplained configuration drift or unusual outbound activity. Where detection is weak, assume you need compensating controls until the software is fully remediated.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org