A vulnerability in the session management system of the Cisco Catalyst SD-WAN Manager multi-tenant feature could allow an authenticated, remote attacker to access another tenant that is being managed by the same Cisco Catalyst SD-WAN Manager instance. This vulnerability requires the multi-tenant feature to be enabled. This vulnerability is due to insufficient user session management within the Cisco Catalyst SD-WAN Manager system. An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to gain unauthorized access to information about another tenant, make configuration changes, or possibly take a tenant offline causing a denial of service condition.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00322.

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Cisco
  • Catalyst Sd-wan Manager
  • Sd-wan Manager

Configuration 1 [-]

OR cpe:2.3:a:cisco:sd-wan_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:sd-wan_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:sd-wan_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:sd-wan_manager:*:*:*:*:*:*:*:*

No data.

No data.

References
Link Providers
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-vman-sc-LRLfu2z cve-icon cve-icon
History

Wed, 17 Dec 2025 05:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'No', 'Exploitation': 'None', 'Technical Impact': 'Total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 23 Oct 2024 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Cisco catalyst Sd-wan Manager
CPEs cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*
Vendors & Products Cisco catalyst Sd-wan Manager
Metrics ssvc

{'options': {'Automatable': 'No', 'Exploitation': 'None', 'Technical Impact': 'Total'}, 'version': '2.0.3'}
cve-icon MITRE

Status: PUBLISHED

Assigner: cisco

Published:

Updated: 2025-12-16T18:23:21.286Z

Reserved: 2022-10-27T18:47:50.372Z

Link: CVE-2023-20254

cve-icon Vulnrichment

Updated: 2024-08-02T09:05:36.889Z

cve-icon NVD

Status : Modified

Published: 2023-09-27T18:15:11.690

Modified: 2024-11-21T07:41:00.253

Link: CVE-2023-20254

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.