Skip to content

CVE · Exploited · On CISA KEV

CVE-2022-20775

Cisco SD-WAN Path Traversal Vulnerability

7.8
CVSS 3.1
1
story
FEB 25
added to KEV
Severity
7.8 High · NVD score
Vendor
Cisco
Product
SD-WAN
Published
Sep 30, 2022
Added to KEV
Feb 25, 2026
KEV deadline
Feb 27, 2026
Ransomware use
Unknown
Weakness
CWE-25, CWE-22
Part of Cisco Catalyst SD-WAN Attacks →

What it is

Cisco SD-WAN CLI contains a path traversal vulnerability that could allow an authenticated local attacker to gain elevated privileges via improper access controls on commands within the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 1 story

Newest first ↑
  1. PolicyCisco, NSA Warn of Attacks Targeting Catalyst SD-WAN Zero DayCisco released software updates on Feb. 25 to fix the vulnerability, which affects both on-premises and cloud deployments of the Catalyst SD-WAN Controller.DENNIS FISHER · 2 MIN

Official references

7 sources

Registries

RegistryNVDScore, weakness and every referenceRegistryCVE.orgThe official CVE recordRegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Vendor advisorysec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdFVendor advisorytools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdFVendor advisorytools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdFVendor advisorytools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF