CVE-2022-20775

HIGH KEV

Cisco SD-WAN Software - Privilege Escalation

Title source: llm

Description

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. This vulnerability is due to improper access controls on commands within the application CLI. An attacker could exploit this vulnerability by running a maliciously crafted command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF

Exploits (1)

nomisec WRITEUP

by bluefalconink · poc

https://github.com/bluefalconink/cisa-ed-26-03-tracker

View Code ZIP pw:eip

References (4)

[Vendor Advisory] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF

[Third Party Advisory, US Government Resource] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-20775

[Exploit, Third Party Advisory] https://github.com/orangecertcc/security-research/security/advisories/GHSA-wmjv-552v-pxjc

[Vendor Advisory] https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF

Scores

CVSS v3 7.8

EPSS 0.0038

EPSS Percentile 59.7%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CISA KEV 2026-02-25

VulnCheck KEV 2026-02-25

ENISA EUVD EUVD-2022-26025

CWE

CWE-22 CWE-25

Status published

Products (10)

cisco/catalyst_sd-wan_manager 20.8

cisco/catalyst_sd-wan_manager 20.6 - 20.6.3

cisco/sd-wan 20.8

cisco/sd-wan 20.6 - 20.6.3

cisco/sd-wan_vbond_orchestrator 20.8

cisco/sd-wan_vbond_orchestrator 20.6 - 20.6.3

cisco/sd-wan_vedge_cloud 20.8

cisco/sd-wan_vedge_cloud < 20.6.3

cisco/sd-wan_vsmart_controller 20.8

cisco/sd-wan_vsmart_controller 20.6 - 20.6.3

Published Sep 30, 2022

KEV Added Feb 25, 2026

Tracked Since Feb 18, 2026