CVE-2022-20844: Cisco Software-Defined Application Visibility and Control on Cisco vManage Static Username and Password Vulnerability

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-09-30 · updated 2026-06-17
Weakness: CWE-798

Description

A vulnerability in authentication mechanism of Cisco Software-Defined Application Visibility and Control (SD-AVC) on Cisco vManage could allow an unauthenticated, remote attacker to access the GUI of Cisco SD-AVC using a default static username and password combination. This vulnerability exists because the GUI is accessible on self-managed cloud installations or local server installations of Cisco vManage. An attacker could exploit this vulnerability by accessing the exposed GUI of Cisco SD-AVC. A successful exploit could allow the attacker to view managed device names, SD-AVC logs, and SD-AVC DNS server IP addresses.

Affected products

Cisco Sd-Wan: from 20.4.1 before 20.6.3; 20.3.4.1, 20.3.4.2, 20.3.5, 20.7.1 — fixed in 20.6.3

How to fix

Upgrade to a fixed version: Cisco Sd-Wan 20.6.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-20844 or the next vulnerability affects your stack