Cisco SD-WAN CLI path traversal

Summaryinfo

A vulnerability identified as critical has been detected in Cisco SD-WAN. This vulnerability affects unknown code of the component CLI. This manipulation causes path traversal. This vulnerability is tracked as CVE-2022-20775. The attack is possible to be carried out remotely. Moreover, an exploit is present. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in Cisco SD-WAN (Network Management Software) (affected version not known) and classified as critical. Affected by this vulnerability is some unknown functionality of the component CLI. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-25. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "/../" sequences that can resolve to a location that is outside of that directory. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. This vulnerability is due to improper access controls on commands within the application CLI. An attacker could exploit this vulnerability by running a maliciously crafted command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF

The weakness was disclosed 10/01/2022 as cisco-sa-sd-wan-priv-E6e8tEdF. The advisory is shared at tools.cisco.com. This vulnerability is known as CVE-2022-20775 since 11/02/2021. Technical details are unknown but an exploit is available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

It is declared as attacked. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 02/25/2026 with a due date of 02/27/2026:

Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL l

Upgrading eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Network Management Software

Vendor

• Cisco

Name

• SD-WAN

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion