Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2022-20775

HighExploitedPublic exploit

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges.

Published Sep 30, 2022 · Updated Mar 2, 2026

Key Facts

Patch immediately
  • CVE-2022-20775 is a high-severity vulnerability (CVSS 7.8 v3.1) affecting Catalyst SD-WAN Manager (Cisco), SD-WAN (Cisco), SD-WAN Vbond Orchestrator (Cisco) and 5 more products.
  • It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Feb 25, 2026. Public exploit code is available.
  • EPSS estimates a 12% probability of exploitation in the next 30 days.
  • Fixed versions are available, including Catalyst SD-WAN Manager 20.6.3, SD-WAN 20.6.3, SD-WAN Vbond Orchestrator 20.6.3.
  • Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v3.1

7.8

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

12%

Higher than 96.1% of all scored CVEs

Exploited in the wild

Yes

4 catalog listings

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2022-20775 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges.

This vulnerability is due to improper access controls on commands within the application CLI. An attacker could exploit this vulnerability by running a maliciously crafted command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF

Known-Exploited Catalog Listings

CatalogAddedRemediation dueRansomware use
CISA KEVFeb 25, 2026Feb 27, 2026Not reported
Industry KEV feedFeb 25, 2026Feb 27, 2026Not reported
CIRCL KEVFeb 25, 2026Feb 27, 2026Not reported
ENISA EUVDFeb 25, 2026n/aNot reported

Required action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Affected Products

15 affected entries in total
ProductAffected versionsFixed in
Catalyst SD-WAN ManagerCisco20.8, >= 20.1.1220.6.3
SD-WANCisco20.820.6.3
SD-WAN Vbond OrchestratorCisco20.820.6.3
SD-WAN Vedge CloudCisco20.8, >= 19.2.120.6.3
SD-WAN Vsmart ControllerCisco20.820.6.3
3 more affected products in the full CVE brief

Patched Releases

Catalyst SD-WAN Manager

20.6.3

SD-WAN

20.6.3

SD-WAN Vbond Orchestrator

20.6.3

SD-WAN Vedge Cloud

20.6.3

SD-WAN Vsmart Controller

20.6.3

Timeline

  1. Publicly disclosed

    Sep 30, 2022

  2. Added to CISA KEV

    Feb 25, 2026

  3. Added to Industry KEV feed

    Feb 25, 2026

  4. Added to CIRCL KEV

    Feb 25, 2026

  5. Added to ENISA EUVD

    Feb 25, 2026

  6. Last updated

    Mar 2, 2026

Weakness Type

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  • CWE-25 Path Traversal: '/../filedir'

References

6 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2022-20775 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo