Vulnerability record · CVE-2022-20775 · published 30 September 2022
CVE-2022-20775: Cisco SD-WAN CLI access control flaw allows root privilege escalation
Cisco · Catalyst Sd Wan Manager
Cisco SD-WAN Software has improper access controls on commands within the application CLI, letting an authenticated local attacker run a crafted command to escalate privileges. A successful exploit yields arbitrary command execution as root, and Cisco states there are no workarounds, only software updates.
Description
A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. This vulnerability is due to improper access controls on commands within the application CLI. An attacker could exploit this vulnerability by running a maliciously crafted command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityIt is in CISA KEV with a two-day remediation deadline, has a public exploit reference, and grants root on SD-WAN infrastructure.
What it is
Cisco SD-WAN Software has improper access controls on commands within the application CLI, letting an authenticated local attacker run a crafted command to escalate privileges. A successful exploit yields arbitrary command execution as root, and Cisco states there are no workarounds, only software updates.
Impact
An attacker with an existing local account gains root-level command execution on the affected SD-WAN component, taking full control of that device.
Attack surface
Reached through the local application CLI; the CVSS vector (AV:L/PR:L/UI:N) requires local access and low privileges, with no user interaction.
Exploitation
CISA added this to KEV with a 2026-02-27 remediation due date, and a third-party advisory is tagged as an exploit reference; EPSS is 0.12475 (96th percentile). No ransomware campaign use is documented.
What to do
- Apply the Cisco software updates referenced in the vendor advisory; there are no workarounds.
- Follow CISA Emergency Directive 26-03 and the CISA Hunt & Hardening Guidance for Cisco SD-WAN devices.
- Restrict and audit local CLI accounts on SD-WAN components, removing unnecessary accounts and enforcing least privilege.
- Treat the 2026-02-27 KEV due date as the remediation deadline and track completion.
- If updates cannot be applied, isolate affected SD-WAN management interfaces per BOD 22-01 guidance or discontinue use.
Detection
- Monitor SD-WAN CLI command logs for crafted or unexpected commands that precede privilege changes.
- Alert on processes running as root that originate from the application CLI or unexpected parent processes.
- Audit local account activity on SD-WAN managers, controllers and edge devices for anomalous command sequences.
- Review file access patterns consistent with path traversal on SD-WAN components.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2022-20775 to the Known Exploited Vulnerabilities catalog on 25 February 2026 as "Cisco SD-WAN Path Traversal Vulnerability". Required action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available. Federal deadline 27 February 2026.
Affected products
5 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2022-20775 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-20775), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
