CVE-2022-20775: Privilege Escalation via Improper CLI Access in Cisco SD-Wan
CVE-2022-20775 Published on September 30, 2022

Cisco SD-WAN Software Privilege Escalation Vulnerability
A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. This vulnerability is due to improper access controls on commands within the application CLI. An attacker could exploit this vulnerability by running a maliciously crafted command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF

NVD

Known Exploited Vulnerability

This Cisco SD-WAN Path Traversal Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Cisco SD-WAN CLI contains a path traversal vulnerability that could allow an authenticated local attacker to gain elevated privileges via improper access controls on commands within the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user.

The following remediation steps are recommended / required by February 27, 2026: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (

Vulnerability Analysis

CVE-2022-20775 can be exploited with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. This vulnerability is known to be actively exploited by threat actors. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

Path Traversal: '/../filedir'

The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "/../" sequences that can resolve to a location that is outside of that directory.


Products Associated with CVE-2022-20775

Want to know whenever a new CVE is published for Cisco products? stack.watch will email you.

Cisco Sd Wan Vmanage
 
Cisco Sd Wan Vbond Orchestrator
 
Cisco Sd Wan Vsmart Controller
 
Cisco Catalyst Sd Wan Manager
 
Cisco Sd Wan
 

Affected Versions

Cisco Catalyst SD-WAN: Cisco Catalyst SD-WAN Manager: Cisco SD-WAN vContainer: Cisco SD-WAN vEdge Cloud: Cisco SD-WAN vEdge Router:

Exploit Probability

EPSS
0.39%
Percentile
59.57%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.