# CVE-2022-20775: A local Cisco SD-WAN user can run commands with full system access

Status: Being used now (CISA KEV, added 2026-02-25)
Who: Businesses running Cisco SD-WAN with local command-line users.
Do this: Install Cisco's security update for SD-WAN.

## Agent prompt (read-only)
Read-only check, change nothing, send nothing anywhere.
Is Cisco SD-WAN (CVE-2022-20775) installed or running on this machine or anywhere I manage?
1. Find every device of this kind on the network: its admin page or console, the firmware or software version, and whether its admin or VPN page is reachable from the internet. Record each version.
2. Compare each version against the fixed version for CVE-2022-20775. Quote the vendor page you used.
3. Report a table: where, version, fixed version, status (exposed / fixed / not installed / not listed by vendor / unsure).
4. List every device or system you could not check and how the owner checks it by hand. Put the highest-risk ones first.
5. List the exact update steps, but do not run them.

## Official description
Cisco SD-WAN CLI contains a path traversal vulnerability that could allow an authenticated local attacker to gain elevated privileges via improper access controls on commands within the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user.

## Sources
- https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems
- https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems
- https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-sd-wan-priv-E6e8tEdF.html
- https://nvd.nist.gov/vuln/detail/CVE-2022-20775

Generated by isitexploited.org from public sources. Verify version numbers against the vendor before acting.