# CVE-2022-20775: Cisco SD-WAN privilege escalation via path traversal in CLI

Source: https://junglewise.ai/threats/cve-2022-20775-cisco-sd-wan-privilege-escalation-via-path-traversal-in-cli  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-25. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2022-20775 · Severity: critical · CVSS 7.8 · Exploited in the wild · Published 2026-02-25

Cisco SD-WAN is a networking solution used to manage and secure wide-area networks across multiple locations. A vulnerability in its command-line interface could allow a user with basic access to bypass security restrictions and gain full administrative control of the device. This could lead to unauthorized configuration changes, data interception, or a complete shutdown of network services.

Technologies: [Cisco SD-WAN](https://junglewise.ai/threats/technologies/sd-wan). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2022-20775 exploited in the wild?** Yes. CVE-2022-20775 is known to be exploited in the wild, first recorded on 25 February 2026. Treat it as urgent.

**How severe is CVE-2022-20775?** Critical severity, with a CVSS score of 7.8, published 25 February 2026.

**Which products and versions are affected?** Cisco SD-WAN Software < 20.6.3, 20.7.x < 20.7.2, 20.8.x.

**Is there a fix for CVE-2022-20775?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2022-20775 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2022-20775?** Check whether you run Cisco SD-WAN or Cisco SD-WAN Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability (CWE-22/CWE-25) exists in the Command Line Interface (CLI) of Cisco SD-WAN Software. The flaw is caused by improper access controls and insufficient validation of input provided to specific CLI commands. An authenticated, local attacker can exploit this by executing a maliciously crafted command to traverse directories and access restricted system files. Successful exploitation allows the attacker to escalate privileges from a standard user to root, enabling arbitrary command execution with full system authority. Cisco has released software updates to address this issue; no workarounds are available.

## Affected products

- Cisco SD-WAN Software < 20.6.3, 20.7.x < 20.7.2, 20.8.x

## Timeline

- 2022-04-20: advisory: Original Cisco advisory published
- 2026-02-25: kev added: Added to CISA Known Exploited Vulnerabilities catalog

## Related threats

- [Citrix SD-WAN and NetScaler Command Injection Vulnerability](https://junglewise.ai/threats/cve-2019-12991-citrix-sd-wan-and-netscaler-command-injection-vulnerability)
- [Citrix SD-WAN and NetScaler SQL Injection Vulnerability](https://junglewise.ai/threats/cve-2019-12989-citrix-sd-wan-and-netscaler-sql-injection-vulnerability)