CVE-2022-20775
Cisco SD-WAN Path Traversal Vulnerability
Description
CVE-2022-20775 is a high-severity privilege escalation vulnerability in the command-line interface (CLI) of Cisco SD-WAN Software. The flaw arises from improper access controls on CLI commands, allowing an authenticated local attacker with low-level privileges to craft malicious commands that bypass intended restrictions. Successful exploitation grants the attacker root-level command execution on the underlying operating system, resulting in full administrative control over the affected device. With a CVSS v3.1 base score of 7.8, this vulnerability affects Cisco SD-WAN versions from 18.3 up to 20.6.1 and from 20.7 up to 20.7.1, as well as Cisco Catalyst SD-WAN Manager across the same version ranges. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2022-20775 to its Known Exploited Vulnerabilities (KEV) catalog, underscoring active exploitation in the wild and mandating remediation by federal agencies.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | catalyst sd-wan manager | < 20.6.3; >= 20.7, < 20.7.2; 20.8 |
| cisco | sd-wan vbond orchestrator | < 20.6.3; >= 20.7, < 20.7.2; 20.8 |
| cisco | sd-wan vedge cloud | < 20.6.3; >= 20.7, < 20.7.2; 20.8 |
| cisco | sd-wan vsmart controller | < 20.6.3; >= 20.7, < 20.7.2; 20.8 |
| cisco | sd-wan | < 20.6.3; >= 20.7, < 20.7.2; 20.8 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF(Vendor Advisory)
- https://github.com/orangecertcc/security-research/security/advisories/GHSA-wmjv-552v-pxjc(Exploit, Third Party Advisory)
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-20775(US Government Resource)
Weakness Type
CWE-22: Path Traversal
The primary weakness underlying CVE-2022-20775 is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal. This weakness class occurs when software uses external input to construct file paths without adequately neutralizing special elements such as ../ sequences. In the context of this vulnerability, the CLI accepts user-supplied arguments that can include directory traversal sequences, enabling an attacker to reference files and execute commands outside the intended directory scope.
CWE-25: Path Traversal ('/../filedir')
A more specific variant, CWE-25, describes path traversal attacks that use the '/../filedir' pattern. This pattern allows the attacker to navigate to parent directories and access arbitrary system resources. In Cisco SD-WAN, the lack of input sanitization on CLI parameters means that crafted path traversal strings can reach privileged system paths, ultimately enabling the attacker to execute commands with root-level permissions.
Impact Analysis
The impact of CVE-2022-20775 is severe across all three dimensions of the CIA triad. Confidentiality is fully compromised because an attacker who obtains root access can read any file on the system, including configuration files, cryptographic keys, VPN credentials, and sensitive network topology information stored on the SD-WAN device. Integrity is equally impacted, as root-level access permits the attacker to modify system configurations, alter routing policies, install persistent backdoors, or tamper with firmware, all without leaving obvious traces to standard monitoring. Availability faces complete risk since the attacker can disable services, disrupt SD-WAN overlay networks, or render the device inoperable by corrupting critical system files.
The attack vector is local (AV:L), meaning the attacker must already have authenticated CLI access to the device. However, the attack complexity is low (AC:L) and requires only low privileges (PR:L), making it exploitable by any user who has basic shell access. In enterprise SD-WAN deployments where multiple administrators or operators may share access to edge devices, the barrier to exploitation is minimal. The scope remains unchanged (S:U), indicating the impact is confined to the vulnerable component itself, though in practice, a compromised SD-WAN node can serve as a pivot point for lateral movement across the managed network infrastructure.
Exploit Maturity
CVE-2022-20775 has been confirmed as actively exploited in the wild by CISA, which added it to the Known Exploited Vulnerabilities catalog. The EPSS score of 1.045% places it in the 77th percentile, indicating that while mass automated exploitation is not prevalent, targeted exploitation by sophisticated threat actors is occurring. The mandatory remediation deadline set by CISA for federal agencies was February 27, 2026, reflecting the urgency of addressing this vulnerability.
The official Cisco security advisory (cisco-sa-sd-wan-priv-E6e8tEdF) provides detailed information about the vulnerability. While no public proof-of-concept exploits have been widely circulated, the path traversal technique involved is well-understood and straightforward for attackers with local access. The combination of a simple exploitation path and confirmed real-world usage makes this vulnerability a priority for organizations running affected Cisco SD-WAN versions, even if the ransomware association remains classified as unknown by CISA.
Remediation
Immediate patching is the most critical remediation step. Organizations must upgrade Cisco SD-WAN Software to version 20.6.1 or later for the 18.x–20.6.x branch, or to version 20.7.1 or later for the 20.7.x branch. The same fixed versions apply to Cisco Catalyst SD-WAN Manager. Cisco has published specific upgrade guidance in advisory cisco-sa-sd-wan-priv-E6e8tEdF, including compatibility notes for different hardware platforms.
Access restriction should be implemented as a compensating control while patches are being deployed. Limit CLI access to only essential personnel using role-based access control (RBAC) and ensure that all CLI sessions are logged and monitored. Remove unnecessary local accounts and enforce strong authentication mechanisms such as TACACS+ or RADIUS for centralized access management.
Post-patch verification is essential. After upgrading, confirm that the patched CLI correctly rejects path traversal sequences by testing with known-bad inputs in a controlled environment. Review system logs for any indicators of prior exploitation, including unexpected root-level command execution, modification of system binaries, or creation of unauthorized user accounts.
Network segmentation around SD-WAN management interfaces provides defense in depth. Ensure that management plane access is restricted to dedicated out-of-band management networks and is not reachable from the data plane or untrusted network segments.
Technical Details
CVE-2022-20775 exploits a path traversal weakness in the Cisco SD-WAN CLI command processing pipeline. The CLI accepts arguments that are passed to underlying system calls without adequate sanitization of directory traversal characters. Specifically, the ../ sequence (and its variants such as ..\ or URL-encoded forms) embedded in command parameters allows an authenticated user to escape the restricted command context and reference arbitrary file system locations.
The CVSS v3.1 vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting a local attack that requires low privileges and no user interaction. The vulnerability exists in the command parser that handles file operations within the SD-WAN management CLI. When a user issues certain commands that accept file path arguments, the application fails to canonicalize or validate the resulting path against an allowlist of permitted directories. This allows the attacker to traverse from the application-restricted directory to system-critical paths such as /etc/, /usr/bin/, or the root filesystem.
Once traversal is achieved, the attacker can read sensitive files to gather information or, more critically, write to locations that enable command execution with elevated privileges. The escalation from a low-privileged CLI user to root occurs because certain writable system paths can be leveraged to inject commands that the operating system executes with root privileges during normal system operations, such as cron jobs or service restarts.
The affected version ranges span Cisco SD-WAN from version 18.3 through 20.6.0 and version 20.7.0, as well as Cisco Catalyst SD-WAN Manager across the same ranges. The fix introduced in versions 20.6.1 and 20.7.1 adds proper input validation and path canonicalization to the CLI command handlers, ensuring that traversal sequences are neutralized before the paths are used in system operations.
Frequently Asked Questions
What is CVE-2022-20775?
CVE-2022-20775 is a privilege escalation vulnerability in the Cisco SD-WAN CLI that allows an authenticated local attacker to execute arbitrary commands as root. It is caused by insufficient access controls and path traversal weaknesses in the command-line interface.
How severe is CVE-2022-20775?
With a CVSS v3.1 score of 7.8 (High), this vulnerability enables complete system compromise including full read and write access to the underlying operating system. CISA has confirmed active exploitation and added it to the KEV catalog.
Which Cisco products are affected?
Cisco SD-WAN Software versions from 18.3 up to (but not including) 20.6.1, versions 20.7 up to 20.7.1, and the corresponding Cisco Catalyst SD-WAN Manager versions in the same ranges are affected.
How do I fix CVE-2022-20775?
Upgrade to Cisco SD-WAN version 20.6.1 or later (for the 18.x–20.6.x train) or version 20.7.1 or later (for the 20.7.x train). Apply the same updates to Cisco Catalyst SD-WAN Manager. Restrict CLI access to authorized personnel only as an interim measure.
Is CVE-2022-20775 being exploited in the wild?
Yes. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, confirming that active exploitation has been observed. Organizations should prioritize patching immediately.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.