VulnSocial
← Back to blog

CVE-2022-20775 – High Severity Path Traversal in Cisco SD‑WAN CLI

Key Takeaways

  • High severity (CVSS 7.8) path traversal in Cisco SD‑WAN CLI.
  • Allows an authenticated local attacker to execute arbitrary commands as root.
  • Added to CISA KEV on 2026‑02‑25; active exploitation observed in the wild.
  • Cisco released patch (software version 20.8); no viable workarounds.
  • Immediate patch and hunt for compromise on all Cisco SD‑WAN devices.

Overview

Cisco SD‑WAN (formerly Viptela) is widely deployed for branch‑to‑core connectivity. In September 2022, CVE-2022-20775 was disclosed, describing a path‑traversal flaw in the CLI of the SD‑WAN software. The vulnerability was added to the U.S. CISA KEV catalog on 2026‑02‑25 after multiple reports of active exploitation. Threat‑actors, including a nation‑state group (UAT‑8616), have chained this flaw with the authentication‑bypass vulnerability CVE-2026-20127 to gain full control of SD‑WAN controllers.

Technical Details

  • Vulnerability type: Path traversal (improper limitation of a pathname) – CWE‑22.
  • Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H – local attack, low complexity, requires low‑privileged authentication, results in high confidentiality, integrity, and availability impact.
  • Root cause: Insufficient validation of file‑system paths in several CLI commands. An attacker who can execute a crafted command can escape the intended directory, read/write arbitrary files, and ultimately spawn a shell as the root user.
  • Exploitation chain: Observed attackers first exploit CVE-2026-20127 (authentication bypass) to obtain a low‑privileged session, then use CVE-2022-20775 to elevate to root.

Severity & Impact

MetricValue
CVSS Score7.8 (High)
SeverityHigh
CWECWE‑22 (Path Traversal)
ImpactConfidentiality, Integrity, Availability – all High

Successful exploitation grants root‑level command execution, enabling attackers to modify routing policies, exfiltrate data, or install persistent backdoors.

Affected Products

The flaw exists in the CLI of Cisco SD‑WAN software running on a wide range of Cisco integrated services routers, including but not limited to:

  • Cisco 1100‑4G, 1100‑8P, 1101, 1109, 1111X, 1120, 4000, 4221, 4321, 4331, 4351, 4431, 4451, 8201, 8804 series.

Cisco has not published an exhaustive list of affected firmware revisions; the vulnerability affects versions prior to the security update released in 20.8. For the full list of affected products and versions, see the CVE page: https://vulnsocial.com/cve/CVE-2022-20775

What Security Teams Should Do Now

  • Verify firmware version on every SD‑WAN device. Anything older than 20.8 is vulnerable.
  • Apply the Cisco security advisory and upgrade to the patched release (patch).
  • Follow the CISA Emergency Directive 26‑03 and the associated Hunt & Hardening Guidance for Cisco SD‑WAN.
  • Conduct a threat‑hunt for indicators of compromise:
    • Look for unusual CLI commands that reference ../ or absolute paths.
    • Search logs for new admin accounts created after the suspected compromise window.
    • Detect any outbound connections from the SD‑WAN controller to known malicious IPs.
  • Restrict CLI access to trusted administrators and enforce multi‑factor authentication where possible.
  • Monitor the live threat‑activity feed for CVE-2022-20775 on the VulnSocial page: https://vulnsocial.com/cve/CVE-2022-20775

Remediation & Mitigation Steps

  1. Inventory – Generate an inventory of all Cisco SD‑WAN controllers and routers. Identify firmware versions.
  2. Patch – Download and install the Cisco SD‑WAN update (version 20.8 or later). Verify the patch is applied successfully.
  3. Apply CISA Guidance – Implement the controls outlined in CISA Emergency Directive 26‑03 and the Hunt & Hardening Guidance.
  4. Hunt for Compromise – Use the indicators above to scan logs and configuration files. Remove any unauthorized accounts or backdoors.
  5. Hardening – Disable unused CLI commands, enforce least‑privilege access, and enable MFA for management interfaces.
  6. Validate – After remediation, run a compliance scan (e.g., OpenVAS, Nessus) to confirm the vulnerability is no longer present.

Bottom Line

CVE-2022-20775 is a High‑severity path‑traversal bug in the Cisco SD‑WAN CLI that enables root‑level command execution. Active exploitation in the wild, combined with an authentication‑bypass chain, makes it a critical risk for any organization running Cisco SD‑WAN. Immediate patch and thorough threat‑hunting are essential.

References

  • Cisco Security Advisory – Privilege Escalation:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF
  • Cisco Security Advisory (mirror):
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF
  • CISA Known Exploited Vulnerabilities Catalog entry:
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-20775
  • Third‑party advisory (OrangeCert):
https://github.com/orangecertcc/security-research/security/advisories/GHSA-wmjv-552v-pxjc
  • Live threat intelligence and timeline:
https://vulnsocial.com/cve/CVE-2022-20775

#CVE202220775 #Cisco #SDWAN #CISAKEV #PathTraversal #High