CVE-2020-4000

—

CVSS 3.1

8.8 high

EPSS

43%p99

Published

Nov 24, 2020 (Nov 24, 2020)

Modified

Jun 17, 2026

Description

The SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3, 3.4.x prior to 3.4.4, and 4.0.x prior to 4.0.1 allows for executing files through directory traversal. An authenticated SD-WAN Orchestrator user is able to traversal directories which may lead to code execution of files.

Vendors: vmware
Products: sd-wan orchestrator
Weakness: CWE-22
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (43.0%)

In the news1 stories

VMware fixed SD-WAN flaws that could allow hackers to target enterprises

Security AffairsNov 23, 12:08 UTC · Nov 23, 2020Vulnerability CVE-2020-3984 CVE-2020-3985 CVE-2020-4000+3 CVEs