CVE-2022-20775: Cisco SD-WAN privilege escalation via path traversal in CLI

CVE-2022-20775 · Severity: critical · CVSS 7.8 · Exploited in the wild · Published 2026-02-25

Cisco SD-WAN is a networking solution used to manage and secure wide-area networks across multiple locations. A vulnerability in its command-line interface could allow a user with basic access to bypass security restrictions and gain full administrative control of the device. This could lead to unauthorized configuration changes, data interception, or a complete shutdown of network services.

Technologies: Cisco SD-WAN. Vendors: Cisco.

Quick answers

Is CVE-2022-20775 exploited in the wild?
Yes. CVE-2022-20775 is known to be exploited in the wild, first recorded on 25 February 2026. Treat it as urgent.
How severe is CVE-2022-20775?
Critical severity, with a CVSS score of 7.8, published 25 February 2026.
Which products and versions are affected?
Cisco SD-WAN Software < 20.6.3, 20.7.x < 20.7.2, 20.8.x.
Is there a fix for CVE-2022-20775?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2022-20775 attacked?
It is attacked with local access, in a network appliance.
Am I affected by CVE-2022-20775?
Check whether you run Cisco SD-WAN or Cisco SD-WAN Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22/CWE-25) exists in the Command Line Interface (CLI) of Cisco SD-WAN Software. The flaw is caused by improper access controls and insufficient validation of input provided to specific CLI commands. An authenticated, local attacker can exploit this by executing a maliciously crafted command to traverse directories and access restricted system files. Successful exploitation allows the attacker to escalate privileges from a standard user to root, enabling arbitrary command execution with full system authority. Cisco has released software updates to address this issue; no workarounds are available.

Affected products

  • Cisco SD-WAN Software < 20.6.3, 20.7.x < 20.7.2, 20.8.x

Timeline

  • 2022-04-20: advisory: Original Cisco advisory published
  • 2026-02-25: kev added: Added to CISA Known Exploited Vulnerabilities catalog

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.