Description
The SD-WAN Orchestrator 3.3.2, 3.4.x, and 4.0.x has default passwords allowing for a Pass-the-Hash Attack. SD-WAN Orchestrator ships with default passwords for predefined accounts which may lead to to a Pass-the-Hash attack.
Scores
CVSS v3
9.8
EPSS
0.0987
EPSS Percentile
93.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-1188
Status
published
Products (2)
vmware/sd-wan_orchestrator
3.3.2 (3 CPE variants)
vmware/sd-wan_orchestrator
3.4.0 - 3.4.4
Published
Nov 24, 2020
Tracked Since
Feb 18, 2026