CVE-2022-20775: Cisco SD-WAN CLI -- Path Traversal Privilege Escalation

Background

Cisco SD-WAN (Software-Defined Wide Area Network) is Cisco’s enterprise WAN solution enabling centralized management of distributed branch office connectivity. The SD-WAN CLI is used by network administrators and operators to configure and manage SD-WAN edge devices, vManage controllers, and vBond orchestrators.

CVE-2022-20775 is a privilege escalation vulnerability in the Cisco SD-WAN CLI involving improper access controls on certain CLI commands (CWE-25 path traversal, CWE-282 improper ownership). An authenticated local attacker with limited CLI access can use path traversal techniques to access or execute commands that are restricted to root-level users, ultimately gaining full OS root access on the SD-WAN device.

CISA added this to the KEV catalog on 2026-02-25. SD-WAN infrastructure is increasingly targeted as organizations migrate branch connectivity to software-defined models, creating high-value network management targets.

Technical Mechanism

CWE-25 (Path Traversal) combined with CWE-282 (Improper Ownership Management) manifests in CLI command handling where directory traversal sequences can bypass command-level access controls.

# Conceptual CLI privilege escalation via path traversal
# Normal restricted user context in Cisco SD-WAN CLI

# Vulnerable: CLI command handler doesn't sanitize the path component
vshell> request execute /usr/local/bin/../../bin/sh

# Or via improper file ownership check:
vshell> file show /etc/sudoers
# Traversal allows reading restricted files

# Root command execution via traversal:
vshell> request software upgrade filepath="../../../bin/sh -i"
# Results in root shell

The path traversal in CLI command argument handling causes the system to resolve the traversal sequences and execute commands or access files that the user’s privilege level should not permit, ultimately providing root-level command execution.

Real-World Exploitation Evidence

CISA’s KEV listing confirms active exploitation. SD-WAN infrastructure is targeted by advanced threat actors for the network access it provides — SD-WAN controllers and edge devices have visibility into all WAN traffic traversing the network. Privilege escalation to root on an SD-WAN controller (vManage) provides administrative control over all SD-WAN policies, potentially enabling traffic interception, route manipulation, or device takeover across an organization’s entire WAN.

Impact Assessment

• Escalation from limited CLI user to full root OS access
• Complete control over SD-WAN device configuration and policies
• Access to VPN encryption keys and WAN traffic interception capability
• Administrative access to connected branch office networks
• Persistent root-level backdoor installation on SD-WAN infrastructure

Affected Versions

Remediation Steps

1. Apply Cisco’s security patches for CVE-2022-20775 immediately.
2. Implement role-based access control for SD-WAN CLI with strict least-privilege enforcement.
3. Restrict CLI access to the SD-WAN management interface to dedicated management networks.
4. Audit CLI command history on SD-WAN devices for evidence of traversal attempts.
5. Rotate all SD-WAN administrative credentials after patching.
6. Enable audit logging for all CLI commands executed on SD-WAN infrastructure.

Detection Guidance

Log Sources: SD-WAN vManage audit logs, device syslog, SIEM with SD-WAN integration.

IOCs: CLI commands containing ../ path traversal sequences; unexpected root-privilege processes on SD-WAN devices; configuration changes made by accounts that should not have administrative access.

Sigma rule:

title: Cisco SD-WAN CLI Path Traversal CVE-2022-20775
logsource:
  product: cisco
  service: sd-wan
detection:
  selection:
    event_type: "cli_command"
    command|contains:
      - '../'
      - '..\\'
      - '%2e%2e'
  condition: selection
level: high

Timeline

References

• NVD — CVE-2022-20775
• CISA KEV — CVE-2022-20775
• Cisco Security Advisory — CVE-2022-20775