CVE-2024-22247 - Vulnerability Details - OpenCVE

VMware SD-WAN Edge contains a missing authentication and protection mechanism vulnerability. A malicious actor with physical access to the SD-WAN Edge appliance during activation can potentially exploit this vulnerability to access the BIOS configuration. In addition, the malicious actor may be able to exploit the default boot priority configured.

No CVSS v4.0

Attack Vector Physical

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://www.vmware.com/security/advisories/VMSA-2024-0008.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: vmware

Published: 2024-04-02T15:49:41.694Z

Updated: 2024-08-01T22:43:33.699Z

Reserved: 2024-01-08T18:43:03.535Z

Link: CVE-2024-22247

Vulnrichment

Updated: 2024-08-01T22:43:33.699Z

NVD

Status : Awaiting Analysis

Published: 2024-04-02T16:15:07.833

Modified: 2024-11-21T08:55:53.110

Link: CVE-2024-22247

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-22247", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2024-01-08T18:43:03.535Z", "datePublished": "2024-04-02T15:49:41.694Z", "dateUpdated": "2024-08-01T22:43:33.699Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "VMware SD-WAN Edge", "vendor": "N/A", "versions": [{"status": "affected", "version": "VMware SD-WAN Edge 4.5.x, VMware SD-WAN Edge 5.x"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\nVMware SD-WAN Edge contains a missing authentication and protection mechanism vulnerability.\n\n\nA malicious actor with physical access to the SD-WAN Edge appliance \nduring activation can potentially exploit this vulnerability to access \nthe BIOS configuration. In addition, the malicious actor may be able to \nexploit the default boot priority configured.\n\n"}], "value": "VMware SD-WAN Edge contains a missing authentication and protection mechanism vulnerability.\n\nA malicious actor with physical access to the SD-WAN Edge appliance \nduring activation can potentially exploit this vulnerability to access \nthe BIOS configuration. In addition, the malicious actor may be able to \nexploit the default boot priority configured.\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"description": "Missing Authentication and Protection Mechanism vulnerability in SD-WAN Edge", "lang": "en"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2024-04-02T15:49:41.694Z"}, "references": [{"url": "https://www.vmware.com/security/advisories/VMSA-2024-0008.html"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-22247", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-02T18:00:39.986241Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:vmware:sd-wan_edge:4.5.x:*:*:*:*:*:*:*"], "vendor": "vmware", "product": "sd-wan_edge", "versions": [{"status": "affected", "version": "4.5.x"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:vmware:sd-wan_edge:5.x:*:*:*:*:*:*:*"], "vendor": "vmware", "product": "sd-wan_edge", "versions": [{"status": "affected", "version": "5.x"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:52:33.704Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:43:33.699Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.vmware.com/security/advisories/VMSA-2024-0008.html", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.vmware.com/security/advisories/VMSA-2024-0008.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:43:33.699Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-22247", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-02T18:00:39.986241Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:vmware:sd-wan_edge:4.5.x:*:*:*:*:*:*:*"], "vendor": "vmware", "product": "sd-wan_edge", "versions": [{"status": "affected", "version": "4.5.x"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:vmware:sd-wan_edge:5.x:*:*:*:*:*:*:*"], "vendor": "vmware", "product": "sd-wan_edge", "versions": [{"status": "affected", "version": "5.x"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-03T15:32:01.460Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "N/A", "product": "VMware SD-WAN Edge", "versions": [{"status": "affected", "version": "VMware SD-WAN Edge 4.5.x, VMware SD-WAN Edge 5.x"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.vmware.com/security/advisories/VMSA-2024-0008.html"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "VMware SD-WAN Edge contains a missing authentication and protection mechanism vulnerability.\n\nA malicious actor with physical access to the SD-WAN Edge appliance \nduring activation can potentially exploit this vulnerability to access \nthe BIOS configuration. In addition, the malicious actor may be able to \nexploit the default boot priority configured.\n\n", "supportingMedia": [{"type": "text/html", "value": "\nVMware SD-WAN Edge contains a missing authentication and protection mechanism vulnerability.\n\n\nA malicious actor with physical access to the SD-WAN Edge appliance \nduring activation can potentially exploit this vulnerability to access \nthe BIOS configuration. In addition, the malicious actor may be able to \nexploit the default boot priority configured.\n\n", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Missing Authentication and Protection Mechanism vulnerability in SD-WAN Edge"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2024-04-02T15:49:41.694Z"}}}, "cveMetadata": {"cveId": "CVE-2024-22247", "state": "PUBLISHED", "dateUpdated": "2024-08-01T22:43:33.699Z", "dateReserved": "2024-01-08T18:43:03.535Z", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "datePublished": "2024-04-02T15:49:41.694Z", "assignerShortName": "vmware"}, "dataVersion": "5.1"}