CVE-2022-20775: Cisco SD-WAN Path Traversal Vulnerability

Cisco SD-WAN contains a path traversal vulnerability in its CLI. An authenticated local attacker could exploit improper access controls on CLI commands to execute arbitrary commands as the root user.

This matters for network operators because root-level access on SD-WAN devices can expose routing, policy, and connected infrastructure to further abuse.

How it works

The flaw class combines path traversal (CWE-25) with improper ownership management (CWE-282). An attacker who already holds a local authenticated CLI session supplies crafted command input that bypasses intended access restrictions, allowing the process to reach and execute files outside the expected directory scope with root privileges.

Am I affected? How to find it in your systems

Cisco SD-WAN software operates on WAN edge routers, controllers, and management appliances. Use existing asset-management or network-discovery tools to locate all instances. Examine configurations that permit local or remote CLI access and compare installed software against the vendor advisory for affected releases and settings.

• Review CLI command audit logs for unexpected path references or privilege-escalation attempts.
• Correlate authentication events with subsequent command execution that deviates from normal administrative patterns.

How to remediate

Apply the vendor update named in the advisory. After patching, review CLI command permissions and remove unnecessary local accounts that retain elevated access.

• Restrict CLI access to only the minimal set of required administrative hosts.
• Enforce role-based command authorization so that authenticated users receive only the privileges needed for their tasks.

If you can't patch immediately

Follow CISA’s Emergency Directive 26-03 and the associated Hunt & Hardening Guidance for Cisco SD-WAN Devices. Apply BOD 22-01 controls for any cloud-hosted instances or discontinue use of the product if mitigations cannot be implemented.

• Segment SD-WAN management interfaces from general-purpose networks.
• Monitor authentication and command logs for indicators of CLI abuse until patches can be applied.
• Disable non-essential CLI features where operationally feasible.

If your data may have been exposed

Actively exploited vulnerabilities of this type can result in breaches. You can run a free exposure scan of your email addresses to check against known breach data.