CVE-2020-4001

Published: Nov 24, 2020Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The SD-WAN Orchestrator 3.3.2, 3.4.x, and 4.0.x has default passwords allowing for a Pass-the-Hash Attack. SD-WAN Orchestrator ships with default passwords for predefined accounts which may lead to to a Pass-the-Hash attack.

Affected (5)

Products: Vmware: Sd Wan Orchestrator

Vmware

1 product

Sd Wan Orchestrator

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Vmware Sd Wan Orchestrator	From 3.4.0 to 3.4.4
Vmware Sd Wan Orchestrator	From 4.0.0 to 4.0.1
Vmware Sd Wan Orchestrator	Version 3.3.2
Vmware Sd Wan Orchestrator	Version 3.3.2 p1
Vmware Sd Wan Orchestrator	Version 3.3.2 p2

Related CWEs

CWE-1188

Initialization of a Resource with an Insecure Default

The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.

References (2)

http://www.vmware.com/security/advisories/VMSA-2020-0025.html

Source: security@vmware.com

Vendor Advisory

http://www.vmware.com/security/advisories/VMSA-2020-0025.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.