The vulnerability stems from the Cisco Catalyst SD‑WAN Controller and Manager storing sensitive credentials—such as passwords, tokens, or API keys—in cleartext. This design flaw, categorized as CWE‑312, permits an attacker who can read the configuration or file system data to obtain those credentials. The resulting loss of confidentiality could allow an attacker to gain full control over the SD‑WAN fabric or use the stolen information to move laterally within the organization’s network.

All versions of Cisco Catalyst SD‑WAN Controller and Cisco Catalyst SD‑WAN Manager are affected. The advisory does not specify exact version ranges, but any deployment using the default configuration that preserves credentials in plaintext is vulnerable.

The CVSS score of 8.8 classifies the issue as high severity, emphasizing the serious confidentiality risk. EPSS data is not available, so the current likelihood of exploitation is unknown, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the most likely attack vector is an attacker with privileged access to the controller or manager’s configuration files, or access to the file system where the cleartext credentials reside.