Skip to content
Fencer Vulns
high 7.8

CVE-2022-20775 kev in the critical feed json

Cisco SD-WAN Software Privilege Escalation Vulnerability

published 2022-09-30 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-26025

cvss
7.8
version 3.1, CNA
cisa kev
Exploited
added 2026-02-25
epss
12.0%
EPSS 12.0% chance of exploitation in 30 days, percentile 96%
public exploits
0
none known

Summary

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges.

This vulnerability is due to improper access controls on commands within the application CLI. An attacker could exploit this vulnerability by running a maliciously crafted command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF

Patch / fix

cisa required action Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

  • cisco catalyst_sd-wan_manager 20.6.3, 20.7.2
  • cisco sd-wan_vbond_orchestrator 20.6.3, 20.7.2
  • cisco sd-wan_vedge_cloud 20.6.3, 20.7.2
  • cisco sd-wan_vsmart_controller 20.6.3, 20.7.2
  • cisco sd-wan 20.6.3, 20.7.2

Timeline

  1. Published
  2. Added to CISA KEV
  3. CISA SSVC: exploitation active
  4. CISA patch deadline

Known exploited

Added
8 mo ago
Patch by
2026-02-27 (8 mo ago)
Ransomware
Not known
Required action
Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Vendor, product
Cisco, SD-WAN
CISA name
Cisco SD-WAN Path Traversal Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
total
Assessed
8 mo ago

Exploit prediction

11.98% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/orangecertcc/security-research/security/advisories/GHSA-wmjv-552v-pxjc referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Cisco Cisco Catalyst SD-WAN
  • Cisco Cisco Catalyst SD-WAN Manager
  • Cisco Cisco SD-WAN vContainer
  • Cisco Cisco SD-WAN vEdge Cloud
  • Cisco Cisco SD-WAN vEdge Router

Classification

Weakness
  • CWE-25 Path Traversal: '/../filedir'
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.