Cisco Catalyst SD‑WAN Manager Stores Passwords in a Recoverable Format (CVE‑2026‑20128)
What It Is
Cisco Catalyst SD‑WAN Manager improperly stores the DCA (Device Configuration Assistant) user password in a recoverable, clear‑text format on the filesystem. An attacker who has a low‑privileged, authenticated account on the manager can read this credential file and elevate to full DCA privileges, effectively gaining unrestricted control over the SD‑WAN fabric.
Exploitability
- Active exploitation: No public reports of active exploitation, but the attack path is trivial for any insider or compromised low‑privileged account.
- Proof‑of‑Concept: The vulnerability is documented in the CISA Known Exploited Vulnerabilities (KEV) catalog; proof‑of‑concept steps have been shared in vendor advisories.
- CVSS: Assigned a High severity rating (≥7.5) reflecting the ease of local privilege escalation and the criticality of SD‑WAN control.
Affected Products
- Vendor: Cisco
- Product: Cisco Catalyst SD‑WAN Manager (all supported versions prior to the vendor‑released fix)
Why It Matters for Compliance & Audit Readiness
The flaw directly undermines access‑control and privileged‑account management controls that are core to frameworks such as NIST CSF, ISO 27001, and PCI‑DSS. Organizations must demonstrate:
- Defensible evidence that privileged credentials are protected by strong cryptographic storage and limited to authorized roles.
- Continuous control monitoring that detects anomalous privilege‑escalation attempts and logs all DCA‑level actions.
- Vendor‑management diligence showing that known high‑severity vulnerabilities are tracked, patched, and documented in the organization’s risk register.
Failing to address this weakness can expose audit findings for inadequate credential protection and insufficient segregation of duties.
Recommended Actions
- Patch Immediately: Apply Cisco’s security update that replaces the recoverable‑format storage with a hashed, non‑recoverable method.
- Rotate DCA Credentials: Generate new, strong passwords for the DCA account and any other privileged service accounts.
- Restrict File Permissions: Ensure the credential file is accessible only to the system account that requires it; audit filesystem ACLs.
- Enforce MFA for Local Access: Require multi‑factor authentication for any local login to the SD‑WAN Manager console.
- Update Access‑Control Policies: Map the DCA role to the “Privileged Access Management” control in your governance framework and capture evidence of the change.
- Monitor & Log: Enable detailed logging of all privileged actions and set up alerts for any read‑access to credential files.
- Document in Risk Register: Record the vulnerability, remediation steps, and residual risk to maintain a defensible audit trail.
Source: CISA KEV – CVE‑2026‑20128