← Vulnerability feed

Vulnerability record · CVE-2020-3985 · published 24 November 2020

CVE-2020-3985: Vmware sd-wan orchestrator vulnerability

Vmware · Sd Wan Orchestrator

The SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3 and 3.4.x prior to 3.4.4 allows an access to set arbitrary authorization levels leading to a privilege escalation issue. An authenticated SD-WAN Orchestrator user may exploit an application weakness and call a vulnerable API to elevate their privileges.

8.8 CVSS 3.1 High EPSS 1.4% · top 28.2%
8.8CVSS 3.1 base score, v2 6.5
1.4%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

The SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3 and 3.4.x prior to 3.4.4 allows an access to set arbitrary authorization levels leading to a privilege escalation issue. An authenticated SD-WAN Orchestrator user may exploit an application weakness and call a vulnerable API to elevate their privileges.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.vmware.com/security/advisories/VMSA-2020-0025.html Vendor Advisory
http://www.vmware.com/security/advisories/VMSA-2020-0025.html Vendor Advisory

Track CVE-2020-3985 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-4001Vmware sd-wan orchestrator insecure default initialization vulnerabilityThe SD-WAN Orchestrator 3.3.2, 3.4.x, and 4.0.x has default passwords allowing for a Pass-the-Hash Attack. SD-WAN Orchestrator ships with default pas…EPSS 2.9%8.8CVE-2020-4000Vmware sd-wan orchestrator path traversal vulnerabilityThe SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3, 3.4.x prior to 3.4.4, and 4.0.x prior to 4.0.1 allows for executing files through directory traversa…EPSS 43%7.2CVE-2020-4002Vmware sd-wan orchestrator vulnerabilityThe SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3, 3.4.x prior to 3.4.4, and 4.0.x prior to 4.0.1 handles system parameters in an insecure way. An auth…EPSS 1.6%6.5CVE-2020-3984Vmware sd-wan orchestrator sql injection vulnerabilityThe SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3 and 3.4.x prior to 3.4.4 does not apply correct input validation which allows for SQL-injection. An a…EPSS 22%6.5CVE-2020-4003Vmware sd-wan orchestrator sql injection vulnerabilityVMware SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3, 3.4.x prior to 3.4.4, and 4.0.x prior to 4.0.1 was found to be vulnerable to SQL-injection attack…EPSS 1.2%

Source: NIST National Vulnerability Database (record CVE-2020-3985), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.