The 8.8 CVSS assigned to this CWE-312 finding warrants scrutiny before treating it as a typical cleartext storage issue. CWE-312 rarely reaches this severity on its own merits—the vulnerability class implies exposure that's gated by attacker access to wherever the cleartext lives. An 8.8 suggests either highly sensitive data or an unusually accessible storage location, and in SD-WAN, the critical variable is where this storage lives: on the management plane (controller-to-controller communication) or the data plane (tunnel traffic). If it's the former, the exposure is likely broader; if the latter, more isolated.
The EPSS score of 0.00187 is notably disconnected from the CVSS, and this gap is analytically informative. EPSS models are trained on CVE-to-exploit timelines for active exploitation—they're structurally blind to credential spill scenarios. When cleartext storage gets chained to post-compromise privilege escalation or lateral movement, the exploitation event recorded is the initial access, not the credential retrieval. The EPSS prediction may accurately model direct exploitability while missing that this finding is almost certainly being used as a force multiplier in incidents tracked under different CVEs. For SD-WAN specifically, a single cleartext controller token authenticates you to the fabric—that's not a blast path requiring chaining, that's root compromise.
More urgent than the CVSS calculation is the temporal exposure window. A software hardening release fixes code going forward; it does nothing for data already written. SD-WAN controllers with months or years of production tenure have a persistent blob of exposed secrets on disk—credentials, keys, tokens—that remain exploitable independent of whether the code is now hardened. The fix closes the faucet but doesn't drain the puddle. Check your deployed controllers for historical configuration exports, diagnostic logs, or session artifacts created before this remediation.
The grouping of multiple cleartext instances under one CVE identifier is a topology signal, not just a process failure. Parallel cleartext storage across controller authentication, tunnel negotiation, and routing policy rarely emerges from independent developer decisions—it emerges from a shared utility, serialization layer, or assumption about how sensitive data flows. If Cisco addressed only the instances rather than the shared pattern, expect recurrence in adjacent code paths within 18-24 months. Request the specific data type enumeration from the advisory—understanding whether this exposed controller private keys, tunnel PSKs, or administrative credentials resolves whether the 8.8 reflects systemic credential exposure or narrower configuration mishandling.