# Cisco Ships Nine Flaws in Its Network Automation Stack — Five Carry the Maximum CVSS Score
## The Threat
Cisco has patched nine security vulnerabilities across two of its enterprise infrastructure platforms — Crosswork Network Automation and Secure Workload — with five of those flaws earning a CVSS score of 10.0. That is not a generous grading curve. A 10.0 means network-accessible, unauthenticated, no user interaction required, complete system compromise. For any organization running these platforms in production, this is a drop-everything-and-patch situation.
Crosswork Network Automation handles network orchestration and intent-based operations at scale, primarily inside service provider and large enterprise backbones. Secure Workload — formerly branded Tetration — provides application workload microsegmentation and dependency mapping across hybrid infrastructure. Both products sit deep inside operational networks, the kind of infrastructure that, once controlled by an attacker, functions as a master pivot point with pre-authorized access to every connected device and workload.
The most severe flaws are rooted in hardcoded credentials and authentication bypass conditions in the platforms' container and API layers. Hardcoded credentials at CVSS 10.0 means exactly what it sounds like: an unauthenticated attacker with network access can log into these systems using built-in accounts that Cisco shipped with the product. There is no brute-forcing required, no social engineering, no zero-day exploit chain — just knowledge of credentials that, by definition, can be extracted directly from the software binary or container image.
## Severity and Impact
| CVE | CVSS Score | Vector String | Vulnerability Class | CWE | Auth Required |
|-----|-----------|---------------|---------------------|-----|---------------|
| See advisory (×5, Crosswork & Secure Workload) | 10.0 | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | Hardcoded / Default Credentials | CWE-798, CWE-1392 | None |
| See advisory (×4, both platforms) | 7.2–9.8 | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | Auth Bypass / Privilege Escalation | CWE-306, CWE-269 | Low or None |
*Nine total CVEs across both platforms. Full CVE identifiers and per-flaw CVSS breakdowns are published in Cisco's security advisories linked below. Cisco confirmed no workaround fully mitigates the critical-severity issues — patching is the only fix.*
## Affected Products
Cisco Crosswork Network Automation
Cisco Secure Workload (formerly Tetration)
Verify your specific release against Cisco's fixed software table in the advisories — both platforms have multiple affected trains.
## Mitigations
Patch immediately. Cisco has released fixed software for both platforms. Given that five vulnerabilities score 10.0 and several exploit hardcoded credentials — which require zero skill to weaponize once the credential is known — there is no credible argument for delayed patching.
Restrict management plane access now. While patching is underway, limit network reachability to Crosswork and Secure Workload management interfaces to explicitly trusted administrative subnets. Neither platform's management surface should be reachable from user networks, guest segments, or the open internet.
Audit authentication logs retroactively. Hardcoded credential exploitation leaves traces. Review login events for both platforms — particularly any activity from built-in or service accounts — going back at least 30 days. If you find anomalous access, treat the platform as compromised.
Inventory API exposure. Any Crosswork or Secure Workload REST API endpoints reachable beyond the management VLAN should be treated as potentially compromised until patched and logs are cleared. Rotate any API tokens or integration credentials that touched the management API.
Apply network segmentation as permanent posture. Post-patch, both platforms belong in dedicated management VLANs with strict ingress and egress ACLs. Network orchestration tools have no business being reachable from production data plane networks.
Contact Cisco TAC if you need expedited patch assistance or suspect your environment may have been accessed via these vulnerabilities before the advisory dropped.
## References
---
## HackWire Analysis
Five CVSS 10.0 scores in a single advisory batch is unusual even by Cisco's prolific patching standards. But the score alone undersells the actual risk. What matters here is *what these products do* — and what an attacker gains by owning them.
Crosswork is not a firewall or an edge appliance. It is the automation brain for large-scale network operations: provisioning, change management, network-wide telemetry, zero-touch deployments. Secure Workload maps application dependencies and enforces policy at the workload level across hybrid environments. A full compromise of either platform is not a single-host compromise. It is a compromise of the control plane that manages hundreds or thousands of hosts. Attackers understand this calculus. Network management and orchestration platforms have become priority targets precisely because the lateral movement they enable is effectively pre-authorized and API-driven.
The hardcoded credential problem is one the industry has been slowly eliminating for a decade. Its appearance in two modern, enterprise-grade orchestration platforms in 2025 is a regression that deserves scrutiny. The old justification — that embedded service accounts ease integration — collapsed years ago when researchers began routinely extracting default credentials from firmware and container images and publishing them. At this point, shipping production infrastructure software with hardcoded root-level credentials is not an oversight. It is a design choice that fails its customers.
The gap between public disclosure and weaponization for credential-based vulnerabilities is measured in hours. Proof-of-concept scripts for hardcoded credential bugs require almost no development effort. Security teams running Crosswork or Secure Workload should treat this advisory with the same urgency they would give confirmed in-the-wild exploitation — because the window before that becomes true is short.
— HackWire Editorial
## Related Coverage