Description
The SD-WAN Orchestrator 3.3.2, 3.4.x, and 4.0.x has default passwords allowing for a Pass-the-Hash Attack. SD-WAN Orchestrator ships with default passwords for predefined accounts which may lead to to a Pass-the-Hash attack.
References (1)
Core 1
Core References
Vendor Advisory x_refsource_misc
http://www.vmware.com/security/advisories/VMSA-2020-0025.html
Scores
CVSS v3
9.8
EPSS
0.0290
EPSS Percentile
85.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-1188
Status
published
Products (2)
vmware/sd-wan_orchestrator
3.3.2 (3 CPE variants)
vmware/sd-wan_orchestrator
3.4.0 - 3.4.4
Published
Nov 24, 2020
Tracked Since
Feb 18, 2026