description: VMware SD-WAN Edge contains a missing authentication and protection mechanism vulnerability.
A malicious actor with physical access to the SD-WAN Edge appliance
during activation can potentially exploit this vulnerability to access
the BIOS configuration. In addition, the malicious actor may be able to
exploit the default boot priority configured.
problem types: Missing Authentication and Protection Mechanism vulnerability in SD-WAN Edge
affected:
{
defaultStatus: unaffected
product: VMware SD-WAN Edge
vendor: N/A
versions:
status: affected, version: VMware SD-WAN Edge 4.5.x, VMware SD-WAN Edge 5.x
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL