CVE-2022-20775 KEV
Patch first
On CISA KEV — known exploited in the wild, due 2026-02-27.
Description
A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. This vulnerability is due to improper access controls on commands within the application CLI. An attacker could exploit this vulnerability by running a maliciously crafted command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF
Scoring
| CVSS | 7.8 (HIGH, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 12.48% — more likely to be exploited than 96% of all CVEs |
| Weakness | CWE-25 |
| On CISA KEV | yes — remediate by 2026-02-27 |
| Public exploit | none known |
| Published | 2022-09-30 |
| Last modified | 2026-06-17 |
CISA KEV
| Name | Cisco SD-WAN Path Traversal Vulnerability |
|---|---|
| Added | 2026-02-25 |
| Due | 2026-02-27 |
| Vendor / product | Cisco / SD-WAN |
| Ransomware use | none reported |
Affected (40)
| Vendor | Product |
|---|---|
| cisco | 1100 integrated services router |
| cisco | 1100-4g integrated services router |
| cisco | 1100-4p integrated services router |
| cisco | 1100-6g integrated services router |
| cisco | 1100-8p integrated services router |
| cisco | 1101 integrated services router |
| cisco | 1101-4p integrated services router |
| cisco | 1109 integrated services router |
| cisco | 1109-2p integrated services router |
| cisco | 1109-4p integrated services router |
| cisco | 1111x integrated services router |
| cisco | 1111x-8p integrated services router |
| cisco | 111x integrated services router |
| cisco | 1120 integrated services router |
| cisco | 1131 integrated services router |
| cisco | 1160 integrated services router |
| cisco | 4000 integrated services router |
| cisco | 4221 integrated services router |
| cisco | 4321 integrated services router |
| cisco | 4321\/k9 integrated services router |
| cisco | 4321\/k9-rf integrated services router |
| cisco | 4321\/k9-ws integrated services router |
| cisco | 4331 integrated services router |
| cisco | 4331\/k9 integrated services router |
| cisco | 4331\/k9-rf integrated services router |
| cisco | 4331\/k9-ws integrated services router |
| cisco | 4351 integrated services router |
| cisco | 4351\/k9 integrated services router |
| cisco | 4351\/k9-rf integrated services router |
| cisco | 4351\/k9-ws integrated services router |
| cisco | 4431 integrated services router |
| cisco | 4451-x integrated services router |
| cisco | catalyst 8000v edge |
| cisco | catalyst cg418-e |
| cisco | catalyst cg522-e |
| cisco | catalyst sd-wan manager |
| cisco | sd-wan |
| cisco | sd-wan vbond orchestrator |
| cisco | sd-wan vedge cloud |
| cisco | sd-wan vsmart controller |
References
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF
- https://github.com/orangecertcc/security-research/security/advisories/GHSA-wmjv-552v-pxjc
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF
- https://github.com/orangecertcc/security-research/security/advisories/GHSA-wmjv-552v-pxjc
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF
→ the Explorer · watch your stack · NVD