CVE-2022-20844
Description
A vulnerability in authentication mechanism of Cisco Software-Defined Application Visibility and Control (SD-AVC) on Cisco vManage could allow an unauthenticated, remote attacker to access the GUI of Cisco SD-AVC using a default static username and password combination. This vulnerability exists because the GUI is accessible on self-managed cloud installations or local server installations of Cisco vManage. An attacker could exploit this vulnerability by accessing the exposed GUI of Cisco SD-AVC. A successful exploit could allow the attacker to view managed device names, SD-AVC logs, and SD-AVC DNS server IP addresses.
How to fix
- cisco sd-wan20.6.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco sd-wan | 20.4.1 ≤ v < 20.6.3, 20.3.4.1, 20.3.4.2, 20.3.5, 20.7.1 | 20.6.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.