VMware just released a security update to address a vulnerability in NSX SD-WAN Edge by VeloCloud. I couldn’t find techincal details but vendor state that VeloCloud by VMware will be removing the web ui component service from the product in future releases. My speculation is that the existing design limitation can merge with former vulnerability (CVE-2017-4947). As a result it cause risk happens. See below hints for reference.

There are two different product editions of NSX: NSX for vSphere and NSX for Multi-Hypervisor (MH). It’s speculated they will merge down the road, but for many possible, or soon to be, users of NSX, it doesn’t matter, because they are used to support different use cases. NSX for vSphere is ideal for VMware environments, while NSX for MH is designed to integrate into cloud environments that leverage open standards, such as OpenStack.

Vulnerability Details for reference:

Unauthenticated Command Injection vulnerability in VMware NSX SD-WAN by VeloCloud

https://www.vmware.com/security/advisories/VMSA-2018-0011.html

CVE-2017-4947: vRealize Automation, vSphere Integrated Containers, and AirWatch Console updates address multiple security vulnerabilities

https://www.vmware.com/security/advisories/VMSA-2018-0006.html