CVE-2022-20775

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2022-09-30

Last updated on: 2026-02-26

Assigner: Cisco Systems, Inc.

Description

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. This vulnerability is due to improper access controls on commands within the application CLI. An attacker could exploit this vulnerability by running a maliciously crafted command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2022-09-30

Last Modified

2026-02-26

Generated

2026-10-16

AI Q&A

2026-02-26

EPSS Evaluated

2025-08-20

NVD

CVE-2022-20775

Affected Vendors & Products

Vendor	Product	Version / Range
cisco	sd-wan_vbond_orchestrator	From 20.7 (inc) to 20.7.2 (exc)
cisco	sd-wan_vbond_orchestrator	20.8
cisco	sd-wan_vsmart_controller	20.8
cisco	sd-wan_vsmart_controller	From 20.7 (inc) to 20.7.2 (exc)
cisco	catalyst_sd-wan_manager	20.8
cisco	catalyst_sd-wan_manager	From 20.7 (inc) to 20.7.2 (exc)
cisco	catalyst_sd-wan_manager	to 20.6.3 (exc)
cisco	sd-wan_vbond_orchestrator	to 20.6.3 (exc)
cisco	sd-wan_vsmart_controller	to 20.6.3 (exc)
cisco	sd-wan_vedge_cloud	to 20.6.3 (exc)
cisco	sd-wan_vedge_cloud	From 20.7 (inc) to 20.7.2 (exc)
cisco	sd-wan_vedge_cloud	20.8
cisco	sd-wan	From 20.7 (inc) to 20.7.2 (exc)
cisco	sd-wan	20.8
cisco	sd-wan	to 20.6.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-25	The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "/../" sequences that can resolve to a location that is outside of that directory.

Attack-Flow Graph

Executive Summary

CVE-2022-20775 is a high-severity vulnerability in the CLI of Cisco SD-WAN Software that allows an authenticated local attacker to gain elevated privileges.

The vulnerability is caused by improper access controls on commands within the application CLI. An attacker can exploit this by running a maliciously crafted command on the CLI, which could lead to executing arbitrary commands as the root user.

More specifically, the flaw involves a path traversal issue in the confd_cli_grp binary used to establish CLI sessions. The attacker can manipulate the USER environment variable to perform path traversal and read arbitrary files, including sensitive secrets used to sign session configurations. This allows forging of session configurations with root privileges, resulting in local privilege escalation to an unconstrained root shell.

Cisco has released software updates to fix this vulnerability, and no workarounds are available.

Detection Guidance

I don't know

Impact Analysis

This vulnerability can have a significant impact as it allows an authenticated local attacker to escalate their privileges to root on affected Cisco SD-WAN devices.

With root privileges, an attacker can execute arbitrary commands with full control over the device, potentially compromising confidentiality, integrity, and availability of the system.

This could lead to unauthorized access to sensitive data, disruption of network services, and further exploitation within the network environment.

Compliance Impact

I don't know

Mitigation Strategies

The only effective mitigation for this vulnerability is to upgrade to a fixed software release provided by Cisco.

Upgrade Cisco SD-WAN Software to version 20.6.3 or later, as this version contains the fix for CVE-2022-20775.
Verify device compatibility and memory requirements before performing the upgrade.
Obtain the fixed software through Cisco or authorized partners.

No workarounds are available to address this vulnerability, so upgrading is critical.

Hi! I’m here to help you understand CVE-2022-20775. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70