CVE-2020-4001

CRITICAL

SD-WAN Orchestrator <4.0 - Default Password

Title source: llm
STIX 2.1

Description

The SD-WAN Orchestrator 3.3.2, 3.4.x, and 4.0.x has default passwords allowing for a Pass-the-Hash Attack. SD-WAN Orchestrator ships with default passwords for predefined accounts which may lead to to a Pass-the-Hash attack.

Scores

CVSS v3 9.8
EPSS 0.0987
EPSS Percentile 93.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-1188
Status published
Products (2)
vmware/sd-wan_orchestrator 3.3.2 (3 CPE variants)
vmware/sd-wan_orchestrator 3.4.0 - 3.4.4
Published Nov 24, 2020
Tracked Since Feb 18, 2026