The vulnerability arises because the Data Collection Agent stores its password in a credential file that can be accessed from a specific HTTP endpoint. An unauthenticated attacker can send a crafted request to that endpoint and retrieve the file, exposing the DCA user password. With the credentials, the attacker can log into other affected SD‑WAN Manager instances and obtain DCA‑level privileges, potentially gaining control over connected edge devices and the network. The flaw is classified as CWE‑257, Credential Management.

Cisco’s Catalyst SD‑WAN Manager, versions up to and including 20.12.6, are impacted. Cisco has verified that releases 20.18 and later are not affected, so deployments running a newer version are secure from this specific disclosure.

The CVSS score of 7.5 signals high severity, yet the EPSS score of less than 1 % indicates that exploitation is currently unlikely. The attacker only needs network access to the vulnerable service and no authentication to read the credential file. While the disclosure can enable privilege escalation on other instances, there are no known public exploits and the threat is deemed low. The flaw is not listed in the KEV catalog, underscoring its limited exploitation risk.