CVE-2022-20844 — Hard-coded Credentials in Cisco Sd-wan
Severity
5.3MEDIUMNVD
EPSS
0.5%
top 32.59%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedSep 30
Latest updateOct 1
Description
A vulnerability in authentication mechanism of Cisco Software-Defined Application Visibility and Control (SD-AVC) on Cisco vManage could allow an unauthenticated, remote attacker to access the GUI of Cisco SD-AVC using a default static username and password combination. This vulnerability exists because the GUI is accessible on self-managed cloud installations or local server installations of Cisco vManage. An attacker could exploit this vulnerability by accessing the exposed GUI of Cisco SD-AVC…
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4
Affected Packages2 packages
🔴Vulnerability Details
2GHSA▶
GHSA-mvqp-5v99-c8gp: A vulnerability in authentication mechanism of Cisco Software-Defined Application Visibility and Control (SD-AVC) on Cisco vManage could allow an unau↗2022-10-01
CVEList▶
Cisco Software-Defined Application Visibility and Control on Cisco vManage Static Username and Password Vulnerability↗2022-09-30
📋Vendor Advisories
1Cisco▶
Cisco Software-Defined Application Visibility and Control on Cisco vManage Static Username and Password Vulnerability↗2022-09-28