A vulnerability in the web‑based management interface of Cisco Catalyst SD‑WAN Manager allows an authenticated, remote attacker to view sensitive information in clear text. The root cause is insufficient access control enforcement for specific template types that are not present in the encryption allowlist. By exploiting this weakness the attacker can read logs on the local device or on a remote logging server and expose authentication credentials, which could then be used to compromise additional network resources.

Cisco Catalyst SD‑WAN Manager is the only product explicitly listed as affected by this vulnerability.

The CVSS score of 6.5 categorizes the issue as moderate severity. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog, indicating a lower public exploitation probability. However, successful exploitation requires an authenticated account with low privileges; once credentials or logs are obtained, an attacker has the potential to elevate privileges and extend compromise across the network. The attack vector is inferred to be remote via the web interface, as the description specifies remote interaction with the management console.