PT-2020-3116 · Cisco · Cisco Sd-Wan Solution

Published 2020-07-15 · Updated 2023-05-23 · CVE-2020-3180

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco SD-WAN Solution Software (affected versions not specified)

Description The issue is related to the use of hardcoded credentials in the Cisco SD-WAN solution. An unauthenticated, local attacker could access an affected device by using an account with a default, static password that has root privileges. This could allow the attacker to log in with root privileges.

Recommendations For all affected versions, consider changing the default, static password of the affected account to a strong, unique password to prevent unauthorized access. As a temporary workaround, restrict access to the account with root privileges until a more permanent solution is available. Avoid using default or static passwords for any accounts, especially those with elevated privileges, to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

CWE-264

Related Identifiers

BDU:2020-03408

CVE-2020-3180

Affected Products

Cisco Sd-Wan Solution

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-3180 · Security Note
• https://osv.dev/vulnerability/CVE-2020-3180 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdscred-HfWWfqBj · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03408 · Security Note