VMware on Wednesday patched a total of six vulnerabilities in its SD-WAN Orchestrator product, including flaws that can be chained by an attacker to steer traffic or shut down an enterprise network.
Three of the vulnerabilities were reported to VMware by Israel-based cybersecurity consulting firm Realmode Labs. VMware has described the security holes as a high-severity SQL injection bug that can allow unauthorized access to data, a medium-severity directory traversal issue that can lead to arbitrary code execution, and a medium-severity problem related to default passwords.
However, Ariel Tempelhof, co-founder and CEO of Realmode Labs, told SecurityWeek that some of the vulnerabilities they’ve found can be chained for unauthenticated remote code execution.
Exploitation of the SQL injection and path traversal vulnerabilities requires authentication, but the password-related flaw found by the company’s researchers allows an attacker to achieve the authentication requirement. Moreover, Tempelhof says VMware has “wildly underrated” this vulnerability as it allows an attacker to change the password of default super-admin accounts.
An attacker who has access to the system’s management interface — this interface could be accessible from the internet in some cases — can exploit these vulnerabilities to cause significant damage considering that the orchestrator manages all SD-WAN endpoints. Exploitation can lead to “traffic steering or even a complete shutdown of the network of a multinational company,” Tempelhof said.
It’s worth noting that Realmode Labs recently also found serious remote code execution vulnerabilities in Silver Peak’s Unity Orchestrator and Citrix SD-WAN. The company has already published blog posts describing those findings and it will soon detail the VMware flaws as well.
VMware’s latest updates for SD-WAN Orchestrator also patch what the company describes as a high-severity vulnerability that allows privilege escalation via a call to a vulnerable API, a high-severity vulnerability that can be exploited by a privileged user for code execution on the underlying operating system, and a medium severity SQL injection that can lead to information disclosure. Exploitation of these vulnerabilities also requires authentication.
Related: Patch for Critical VMware ESXi Vulnerability Incomplete
Related: VMware Patches Critical Code Execution Vulnerability in ESXi
Related: Google Researcher Finds Vulnerability in VMware Virtualization Products