PT-2024-3861 · Vmware · Vmware Sd-Wan Edge

Saif Aziz + 1 · Published 2024-04-02 · Updated 2024-07-03 · CVE-2024-22247

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions VMware SD-WAN Edge (affected versions not specified)

Description The issue is related to a missing authentication and protection mechanism in the VMware SD-WAN Edge appliance. A malicious actor with physical access to the appliance during activation can potentially exploit this to access the BIOS configuration. Additionally, the malicious actor may be able to exploit the default boot priority configured.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

CWE-303

CWE-1390

Related Identifiers

BDU:2024-04259

CVE-2024-22247

Affected Products

Vmware Sd-Wan Edge

References · 13

• https://bdu.fstec.ru/vul/2024-04259 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-22247 · Security Note
• https://t.me/cvenotify/75519 · Telegram Post
• https://twitter.com/CVEnew/status/1775189980773560578 · Twitter Post
• https://t.me/cvenotify/75496 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1775229440722690512 · Twitter Post
• https://vmware.com/security/advisories/VMSA-2024-0008.html · Note
• https://knowledge.broadcom.com/external/article?legacyId=97391 · Note
• https://twitter.com/The_Cyber_News/status/1776214544668635486 · Twitter Post
• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24271 · Note
• https://twitter.com/pravin_karthik/status/1775536104273256790 · Twitter Post
• https://twitter.com/xvonfers/status/1775499767218327873 · Twitter Post
• https://twitter.com/RedPacketSec/status/1775449361209520328 · Twitter Post