CVE-2019-1950

Cisco IOS XE SD-WAN Software Default Credentials Vulnerability

State: Published
Severity: 8.4 High
Published: Feb 19, 2020
Updated: Nov 15, 2024
Reserved: Dec 6, 2018

Description

A vulnerability in Cisco IOS XE SD-WAN Software could allow an unauthenticated, local attacker to gain unauthorized access to an affected device. The vulnerability is due to the existence of default credentials within the default configuration of an affected device. An attacker who has access to an affected device could log in with elevated privileges. A successful exploit could allow the attacker to take complete control of the device. This vulnerability affects Cisco devices that are running Cisco IOS XE SD-WAN Software releases 16.11 and earlier.

Scores

CVSS	Score	Vector	Source
3.1	8.4 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	cisco

Weaknesses

CWE-255 Credentials Management

Affected Products

Product	Versions
Cisco IOS XE SD-WAN SoftwareCisco	16.11 and earlierAffected

References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-cred-EVGSF259

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.