What is CVE-2024-22247?

CVE-2024-22247 is a medium-severity vulnerability in VMware Sd-Wan Edge, classified under Improper Authentication. CVSS score: 4.8/10. Published 2024-04-02.

How severe is CVE-2024-22247?

Medium severity. CVSS v3 base score is 4.8 out of 10.

Is CVE-2024-22247 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in VMware Sd-Wan Edge

CVE-2024-22247

VMware SD-WAN Edge contains a missing authentication and protection mechanism vulnerability. A malicious actor with physical access to the SD-WAN Edge appliance during activation can potentially exploit this vulnerability to access the BIOS configuration. In addition, the malicious actor may be able to exploit the default boot priority configured.

Vulnerability class: Broken Authentication

EPSS: 0.002 (12.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.8 (Medium). Vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H.

Affected products

N/a Vmware Sd-wan Edge — versions VMware SD-WAN Edge 4.5.x, VMware SD-WAN Edge 5.x

Weakness classification (CWE)

CWE-287 — Improper Authentication

Public proof-of-concept exploits

ARPSyndicate/cve-scores

References

security@vmware.com

Frequently asked questions

What is CVE-2024-22247?: CVE-2024-22247 is a medium-severity vulnerability in VMware Sd-Wan Edge, classified under Improper Authentication. CVSS score: 4.8/10. Published 2024-04-02.
How severe is CVE-2024-22247?: Medium severity. CVSS v3 base score is 4.8 out of 10.
Is CVE-2024-22247 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.