CVE-2025-20157 Cisco Catalyst vManage Certificate Validation Vulnerability

Medium 5.9 Published 7 May 2025 Updated 7 May 2025

An attacker in a privileged network position can bypass certificate validation to intercept traffic and steal sensitive credentials from Cisco Catalyst SD-WAN Manager.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-20157?

CVE-2025-20157 is a medium-severity vulnerability in Cisco Catalyst Sd-Wan Manager, published on 7 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in certificate validation processing of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an unauthenticated, remote attacker to gain access to sensitive information. This vulnerability is due to improper validation of certificates that are used by the Smart Licensing feature. An attacker with a privileged network position could exploit this vulnerability by intercepting traffic that is sent over the Internet. A successful exploit could allow the attacker to gain access to sensitive information, including credentials used by the device to connect to Cisco cloud services.

Weakness: CWE-295

Which versions are affected by CVE-2025-20157?

It affects 1 product.

Products include Cisco Catalyst Sd-Wan Manager.

How do I fix CVE-2025-20157?

No fix has been published for CVE-2025-20157 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-20157 being exploited?

There is no known exploitation of CVE-2025-20157 in the wild and no public exploit code.

All Cisco Catalyst Sd-Wan Manager vulnerabilities

Sources

Also known as GHSA-vq58-8wp2-wc83.