Default Password Vulnerability in VMware SD-WAN Orchestrator

CVE-2020-4001

Summary

The VMware SD-WAN Orchestrator versions 3.3.2, 3.4.x, and 4.0.x contain a security weakness due to the use of default passwords for predefined accounts. This vulnerability can be exploited via a Pass-the-Hash attack, where an attacker can gain unauthorized access by using the hashed credentials instead of the actual password. It is critical for users to change default passwords to help secure their environments against potential exploitation.

References