CVE-2022-20775

Cisco SD-WAN Software Privilege Escalation Vulnerability

HIGH

7.8

CVSS Score

Published: September 30, 2022 at 06:45 PM UTC

Updated: June 17, 2026 at 04:25 AM UTC

86 products affected across 1 vendorCatalyst Sd WAN ManagerSd WANSd WAN Vbond Orchestrator

Using Cisco SD-WAN Solution by Cisco?

Get instant alerts when new vulnerabilities affect Cisco SD-WAN Solution - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploitation

CISA KEV

Exploit prediction

EPSS 12%

SSVC

Active

Actively Exploited

CISA Known Exploited Vulnerabilities (KEV) Catalog

EPSS Score12.5%

EPSS (Exploit Prediction Scoring System) estimates a 12.5% chance this CVE is exploited in the wild within the next 30 days — higher than 96% of all CVEs. It complements CVSS: a high EPSS on a mid-severity CVE can still be urgent.

Cisco SD-WAN CLI contains a path traversal vulnerability that could allow an authenticated local attacker to gain elevated privileges via improper access controls on commands within the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user.

Required Action

Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Ransomware Use

Unknown

Added to KEV

Feb 25, 2026

Remediation Due

Feb 27, 2026

243 days overdue

Notes

CISA Mitigation Instructions: https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems

https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems

https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-sd-wan-priv-E6e8tEdF.html

https://nvd.nist.gov/vuln/detail/CVE-2022-20775

Description

Multiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. These vulnerabilities are due to improper access controls on commands within the application CLI. An attacker could exploit these vulnerabilities by running a malicious command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Catalyst Sd WAN Manager · Cisco

95%

v < 20.6.320.7 ≤ v < 20.7.217.2.10 17.2.4 17.2.5 17.2.6 17.2.7 17.2.8 17.2.9 18.2.0 18.3.0 18.3.1 18.3.1.1 18.3.3 18.3.3.1 18.3.4 18.3.5 18.3.6 18.3.6.1 18.3.7 18.3.8 18.4.0 18.4.0.1 18.4.1 18.4.3 18.4.302 18.4.303 18.4.4 18.4.5 18.4.501_ES 18.4.6 19.0.0 19.0.1a 19.1.0 19.2.0 19.2.097 19.2.098 19.2.099 19.2.1 19.2.2 19.2.3 19.2.31 19.2.32 19.2.4 19.2.4.0.1 19.2.4.0.8 19.2.4.0.9 19.2.929 19.3.0 20.1.1 20.1.1.1 20.1.12 20.1.2 20.1.2_937 20.1.3 20.3.1 20.3.2 20.3.2.0.5 20.3.2.0.6 20.3.2.1 20.3.2.1_927 20.3.2.1_930 20.3.2_925 20.3.2_928 20.3.2_929 20.3.2_937 20.3.3 20.3.3.0.14 20.3.3.0.16 20.3.3.0.17 20.3.3.0.18 20.3.3.0.2 20.3.3.0.4 20.3.3.0.8 20.3.3.1 20.3.3.1.1 20.3.3.1.10 20.3.3.1.2 20.3.3.1.5 20.3.3.1.7 20.3.3.2 20.3.4 20.3.4.0.1 20.3.4.0.11 20.3.4.0.19 20.3.4.0.20 20.3.4.0.24 20.3.4.0.25 20.3.4.0.26 20.3.4.0.5 20.3.4.0.6 20.3.4.0.9 20.3.4.1 20.3.4.1.1 20.3.4.1.2 20.3.4.2 20.3.4.2.1 20.3.4.2.2 20.3.4.3 20.3.5 20.3.5.0.7 20.3.5.0.8 20.3.5.0.9 20.3.5.1 20.3.6 20.3.7 20.3.7.1 20.3.7.2 20.3.8 20.3.813 20.3.814 20.4.1 20.4.1.0.01 20.4.1.0.02 20.4.1.0.1 20.4.1.1 20.4.1.1.5 20.4.1.2 20.4.2 20.4.2.0.1 20.4.2.0.2 20.4.2.0.4 20.4.2.1 20.4.2.1.1 20.4.2.2 20.4.2.2.1 20.4.2.2.2 20.4.2.2.3 20.4.2.2.4 20.5.0.1.1 20.5.1 20.5.1.0.1 20.5.1.0.2 20.5.1.1 20.5.1.2 20.6.0.18.3 20.6.0.18.4 20.6.1 20.6.1.0.1 20.6.1.1 20.6.1.2 20.6.2 20.6.2.0.4 20.6.2.1 20.6.2.2 20.6.2.2.2 20.6.2.2.3 20.6.2.2.4 20.6.2.2.7 20.6.3 20.7.1 20.7.1.0.2 20.7.1.1 20.7.1EFT2 20.8

Affected range stops below 20.6.3, so it looks safe — our inference, not a vendor statement

Affected range stops below 20.7.2, so it looks safe — our inference, not a vendor statement

Sd WAN · Cisco

95%

Affected range stops below 20.6.3, so it looks safe — our inference, not a vendor statement

Affected range stops below 20.7.2, so it looks safe — our inference, not a vendor statement

cisco-1100-4g-integrated-services-router (environment) · cisco-1100-4p-integrated-services-router (environment) · cisco-1100-6g-integrated-services-router (environment) · cisco-1100-8p-integrated-services-router (environment) · cisco-1100-integrated-services-router (environment) · cisco-1101-4p-integrated-services-router (environment) · cisco-1101-integrated-services-router (environment) · cisco-1109-2p-integrated-services-router (environment) · cisco-1109-4p-integrated-services-router (environment) · cisco-1109-integrated-services-router (environment) · cisco-1111x-8p-integrated-services-router (environment) · cisco-1111x-integrated-services-router (environment) · cisco-111x-integrated-services-router (environment) · cisco-1120-integrated-services-router (environment) · cisco-1131-integrated-services-router (environment) · cisco-1160-integrated-services-router (environment) · cisco-4000-integrated-services-router (environment) · cisco-4221-integrated-services-router (environment) · cisco-4321-integrated-services-router (environment) · cisco-4321-k9-integrated-services-router (environment) · cisco-4321-k9-rf-integrated-services-router (environment) · cisco-4321-k9-ws-integrated-services-router (environment) · cisco-4331-integrated-services-router (environment) · cisco-4331-k9-integrated-services-router (environment) · cisco-4331-k9-rf-integrated-services-router (environment) · cisco-4331-k9-ws-integrated-services-router (environment) · cisco-4351-integrated-services-router (environment) · cisco-4351-k9-integrated-services-router (environment) · cisco-4351-k9-rf-integrated-services-router (environment) · cisco-4351-k9-ws-integrated-services-router (environment) · cisco-4431-integrated-services-router (environment) · cisco-4451-integrated-services-router (environment) · cisco-4451-x-integrated-services-router (environment) · cisco-4461-integrated-services-router (environment) · cisco-8101-32fh (environment) · cisco-8101-32h (environment) · cisco-8102-64h (environment) · cisco-8201 (environment) · cisco-8201-32fh (environment) · cisco-8202 (environment) · cisco-8804 (environment) · cisco-8808 (environment) · cisco-8812 (environment) · cisco-8818 (environment) · cisco-8831 (environment) · cisco-asr-1000 (environment) · cisco-asr-1000-x (environment) · cisco-asr-1001 (environment) · cisco-asr-1001-hx (environment) · cisco-asr-1001-hx-r (environment) · cisco-asr-1001-x (environment) · cisco-asr-1001-x-r (environment) · cisco-asr-1002 (environment) · cisco-asr-1002-hx (environment) · cisco-asr-1002-hx-r (environment) · cisco-asr-1002-x (environment) · cisco-asr-1002-x-r (environment) · cisco-asr-1004 (environment) · cisco-asr-1006 (environment) · cisco-asr-1006-x (environment) · cisco-asr-1009-x (environment) · cisco-asr-1013 (environment) · cisco-asr-1023 (environment) · cisco-catalyst-8000v-edge (environment) · cisco-catalyst-8200 (environment) · cisco-catalyst-8300 (environment) · cisco-catalyst-8300-1n1s-4t2x (environment) · cisco-catalyst-8300-1n1s-6t (environment) · cisco-catalyst-8300-2n2s-4t2x (environment) · cisco-catalyst-8300-2n2s-6t (environment) · cisco-catalyst-8500 (environment) · cisco-catalyst-8500-4qc (environment) · cisco-catalyst-8500l (environment) · cisco-catalyst-8510csr (environment) · cisco-catalyst-8510msr (environment) · cisco-catalyst-8540csr (environment) · cisco-catalyst-8540msr (environment) · cisco-catalyst-cg418-e (environment) · cisco-catalyst-cg522-e (environment)

Sd WAN Vbond Orchestrator · Cisco

95%

v < 20.6.320.7 ≤ v < 20.7.220.8

Affected range stops below 20.6.3, so it looks safe — our inference, not a vendor statement

Affected range stops below 20.7.2, so it looks safe — our inference, not a vendor statement