Riskcovery

CVE-2025-20157

Cisco Catalyst vManage Certificate Validation Vulnerability

State
Published
Severity
5.9 Medium
Published
May 7, 2025
Updated
May 7, 2025
Reserved
Oct 10, 2024

Read the record on cve.org

Description

A vulnerability in certificate validation processing of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an unauthenticated, remote attacker to gain access to sensitive information.

This vulnerability is due to improper validation of certificates that are used by the Smart Licensing feature. An attacker with a privileged network position could exploit this vulnerability by intercepting traffic that is sent over the Internet. A successful exploit could allow the attacker to gain access to sensitive information, including credentials used by the device to connect to Cisco cloud services.

Scores

CVSSScoreVectorSource
3.15.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:Ncisco

Weaknesses

  • CWE-295 Improper Certificate Validation

Affected Products

ProductVersions
Cisco Catalyst SD-WAN ManagerCisco
  • 20.1.12Affected
  • 19.2.1Affected
  • 18.4.4Affected
  • 18.4.5Affected
  • 20.1.1.1Affected
  • 20.1.1Affected
  • 19.3.0Affected
  • 19.2.2Affected
  • 19.2.099Affected
  • 18.3.6Affected
  • 18.3.7Affected
  • 19.2.0Affected
  • 18.3.8Affected
  • 19.0.0Affected
  • 19.1.0Affected
  • 18.4.302Affected
  • 18.4.303Affected
  • 19.2.097Affected
  • 19.2.098Affected
  • 17.2.10Affected
  • 18.3.6.1Affected
  • 19.0.1aAffected
  • 18.2.0Affected
  • 18.4.3Affected
  • 18.4.1Affected
  • and 276 more versions

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.