IRONSMITHINTEL
HIGHCVSS7.8
|
Actively Exploited
|CISA KEV|CVE-2022-20775|Auth: low — authenticated user|Reboot: required|Manual only

Cisco SD-WAN Path Traversal Vulnerability

Cisco SD-WAN CLI contains a path traversal vulnerability that could allow an authenticated local attacker to gain elevated privileges via improper access controls on commands within the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user.

Published Sep 30, 2022 · Updated May 16, 2026
Why patchRisk explained in plain English
Worst-case scenarioIf unpatched

A local attacker, with a low-privilege account, can achieve full data confidentiality loss, arbitrary modification of data, complete denial of service or system unavailability. Federal agencies are required to remediate by 2026-02-27 under CISA BOD 22-01.

How the attack worksNo clicks needed

This is a Software Vulnerability (CWE-25) (CWE-25) vulnerability in Cisco SD-WAN. A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. This vulnerability is due to improper access controls on commands within the application CLI. An attacker could exploit this vulnerability by running a maliciously crafted command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF Exploitation requires local access, low attack complexity, a low-privilege authenticated account, and no user interaction required.

Am I affected?Quick check

Probably yes if any of these apply:

●Network Security Team
●Firewall Administrators
●IT Security
●Running catalyst sd-wan manager: v < 20.6.3, 20.7 ≤ v < 20.7.2, 20.8; sd-wan vbond orchestrator: v < 20.6.3, 20.7 ≤ v < 20.7.2, 20.8; sd-wan vedge cloud: v < 20.6.3, 20.7 ≤ v < 20.7.2, 20.8; sd-wan vsmart controller: v < 20.6.3, 20.7 ≤ v < 20.7.2, 20.8; sd-wan: v < 20.6.3, 20.7 ≤ v < 20.7.2, 20.8
Real-world incidentsWhat we've seen

Active exploitation documented in the wild. Threat-research write-up: https://github.com/orangecertcc/security-research/security/advisories/GHSA-wmjv-552v-pxjc

How to patch

Manual remediation steps

Apply the Vendor Patch

This vulnerability is in the CISA Known Exploited Vulnerabilities catalog — apply the vendor's security update as soon as possible.

CISA required action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

References

    1
    Vendor advisory: https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-sd-wan-priv-E6e8tEdF.html
    1
    NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2022-20775
    1
    CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-20775
PowerShell automationComing soon

No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.

References

↗ CVE-2022-20775↗ NVD↗ Vendor Advisory