CVE-2020-4001
published 2020-11-24CVE-2020-4001: The SD-WAN Orchestrator 3.3.2, 3.4.x, and 4.0.x has default passwords allowing for a Pass-the-Hash Attack. SD-WAN Orchestrator ships with default passwords for…
PriorityP350critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
2.90%
85.3th percentile
The SD-WAN Orchestrator 3.3.2, 3.4.x, and 4.0.x has default passwords allowing for a Pass-the-Hash Attack. SD-WAN Orchestrator ships with default passwords for predefined accounts which may lead to to a Pass-the-Hash attack.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vmware | sd-wan_orchestrator | — | — |
| vmware | sd-wan_orchestrator | 3.4.0 – 3.4.4 | — |
| vmware | sd-wan_orchestrator | 4.0.0 – 4.0.1 | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VMware
VMware SD-WAN Orchestrator updates address multiple security vulnerabilities (CVE-2020-3984, CVE-2020-3985, CVE-2020-4000, CVE-2020-4001, CVE-2020-4002 ,CVE-2020-4003)
vendor_vmware·2020-11-18·CVSS 6.5
CVE-2020-3984 [MEDIUM] VMware SD-WAN Orchestrator updates address multiple security vulnerabilities (CVE-2020-3984, CVE-2020-3985, CVE-2020-4000, CVE-2020-4001, CVE-2020-4002 ,CVE-2020-4003)
VMSA-2020-0025: VMware SD-WAN Orchestrator updates address multiple security vulnerabilities (CVE-2020-3984, CVE-2020-3985, CVE-2020-4000, CVE-2020-4001, CVE-2020-4002 ,CVE-2020-4003)
The SD-WAN Orchestrator does not apply correct input validation which allows for SQL-injection. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.1.
CVEs: CVE-2020-3984, CVE-2020-3985, CVE-2020-4000, CVE-2020-4001, CVE-2020-4002, CVE-2020-4003
Affected products: VMware SD-WAN, VMware VeloCloud
GHSA
GHSA-fxm9-pj4r-698p: The SD-WAN Orchestrator 3
ghsa_unreviewed·2022-05-24
CVE-2020-4001 [CRITICAL] CWE-798 GHSA-fxm9-pj4r-698p: The SD-WAN Orchestrator 3
The SD-WAN Orchestrator 3.3.2, 3.4.x, and 4.0.x has default passwords allowing for a Pass-the-Hash Attack. SD-WAN Orchestrator ships with default passwords for predefined accounts which may lead to to a Pass-the-Hash attack.
Suricata
ET EXPLOIT VMware SD-WAN Orchestrator Authentication Bypass (CVE-2020-4001)
suricata·2022-02-04·CVSS 9.8
CVE-2020-4001 [CRITICAL] ET EXPLOIT VMware SD-WAN Orchestrator Authentication Bypass (CVE-2020-4001)
ET EXPLOIT VMware SD-WAN Orchestrator Authentication Bypass (CVE-2020-4001)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT VMware SD-WAN Orchestrator Authentication Bypass (CVE-2020-4001)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"|2f|login|2f|doResetPassword|2e|html"; http.request_body; content:"super|40|velocloud|2e|net"; fast_pattern; content:"|7b|CLEAR|7b|"; nocase; content:"logicalId"; nocase; reference:cve,2020-4001; classtype:attempted-admin; sid:2035102; rev:2; metadata:created_at 2022_02_04, cve CVE_2020_4001, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_02_04, mitre_tactic_id TA0001, mitre_tactic_name Initial_Acces
No public exploits indexed.
No writeups or analysis indexed.
2020-11-24
Published