CVE-2022-20775 : Multiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an auth

Multiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. These vulnerabilities are due to improper access controls on commands within the application CLI. An attacker could exploit these vulnerabilities by running a malicious command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user.

Published 2022-09-30 19:15:11

Updated 2023-10-16 16:35:25

Source Cisco Systems, Inc.

View at NVD, CVE.org

Vulnerability category: Directory traversal

Products affected by CVE-2022-20775

Cisco » Sd-wan
Versions from including (>=) 20.6 and before (<) 20.6.3
cpe:2.3:a:cisco:sd-wan:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Catalyst 8000v Edge » Version: N/A
When used together with: Cisco » Catalyst Cg418-e » Version: N/A
When used together with: Cisco » Catalyst Cg522-e » Version: N/A
When used together with: Cisco » 1100-4g Integrated Services Router » Version: N/A
When used together with: Cisco » 1100-4p Integrated Services Router » Version: N/A
When used together with: Cisco » 1100-6g Integrated Services Router » Version: N/A
When used together with: Cisco » 1100-8p Integrated Services Router » Version: N/A
When used together with: Cisco » 1100 Integrated Services Router » Version: N/A
When used together with: Cisco » 1101-4p Integrated Services Router » Version: N/A
When used together with: Cisco » 1101 Integrated Services Router » Version: N/A
When used together with: Cisco » 1109-2p Integrated Services Router » Version: N/A
When used together with: Cisco » 1109-4p Integrated Services Router » Version: N/A
When used together with: Cisco » 1109 Integrated Services Router » Version: N/A
When used together with: Cisco » 1111x-8p Integrated Services Router » Version: N/A
When used together with: Cisco » 1111x Integrated Services Router » Version: N/A
When used together with: Cisco » 111x Integrated Services Router » Version: N/A
When used together with: Cisco » 1120 Integrated Services Router » Version: N/A
When used together with: Cisco » 1131 Integrated Services Router » Version: N/A
When used together with: Cisco » 1160 Integrated Services Router » Version: N/A
When used together with: Cisco » 4000 Integrated Services Router » Version: N/A
When used together with: Cisco » 4221 Integrated Services Router » Version: N/A
When used together with: Cisco » 4321/k9-rf Integrated Services Router » Version: N/A
When used together with: Cisco » 4321/k9-ws Integrated Services Router » Version: N/A
When used together with: Cisco » 4321/k9 Integrated Services Router » Version: N/A
When used together with: Cisco » 4321 Integrated Services Router » Version: N/A
When used together with: Cisco » 4331/k9-rf Integrated Services Router » Version: N/A
When used together with: Cisco » 4331/k9-ws Integrated Services Router » Version: N/A
When used together with: Cisco » 4331/k9 Integrated Services Router » Version: N/A
When used together with: Cisco » 4331 Integrated Services Router » Version: N/A
When used together with: Cisco » 4351/k9-rf Integrated Services Router » Version: N/A
When used together with: Cisco » 4351/k9-ws Integrated Services Router » Version: N/A
When used together with: Cisco » 4351/k9 Integrated Services Router » Version: N/A
When used together with: Cisco » 4351 Integrated Services Router » Version: N/A
When used together with: Cisco » 4431 Integrated Services Router » Version: N/A
When used together with: Cisco » 4451-x Integrated Services Router » Version: N/A
When used together with: Cisco » 4451 Integrated Services Router » Version: N/A
When used together with: Cisco » 4461 Integrated Services Router » Version: N/A
When used together with: Cisco » 8101-32fh » Version: N/A
When used together with: Cisco » 8101-32h » Version: N/A
When used together with: Cisco » 8102-64h » Version: N/A
When used together with: Cisco » 8201 » Version: N/A
When used together with: Cisco » 8201-32fh » Version: N/A
When used together with: Cisco » 8202 » Version: N/A
When used together with: Cisco » 8804 » Version: N/A
When used together with: Cisco » 8808 » Version: N/A
When used together with: Cisco » 8812 » Version: N/A
When used together with: Cisco » 8818 » Version: N/A
When used together with: Cisco » 8831 » Version: N/A
When used together with: Cisco » Asr 1000 » Version: N/A
When used together with: Cisco » Asr 1000-x » Version: N/A
When used together with: Cisco » Asr 1001 » Version: N/A
When used together with: Cisco » Asr 1001-hx » Version: N/A
When used together with: Cisco » Asr 1001-hx R » Version: N/A
When used together with: Cisco » Asr 1001-x » Version: N/A
When used together with: Cisco » Asr 1001-x R » Version: N/A
When used together with: Cisco » Asr 1002 » Version: N/A
When used together with: Cisco » Asr 1002-hx » Version: N/A
When used together with: Cisco » Asr 1002-hx R » Version: N/A
When used together with: Cisco » Asr 1002-x » Version: N/A
When used together with: Cisco » Asr 1002-x R » Version: N/A
When used together with: Cisco » Asr 1004 » Version: N/A
When used together with: Cisco » Asr 1006 » Version: N/A
When used together with: Cisco » Asr 1006-x » Version: N/A
When used together with: Cisco » Asr 1009-x » Version: N/A
When used together with: Cisco » Asr 1013 » Version: N/A
When used together with: Cisco » Asr 1023 » Version: N/A
When used together with: Cisco » Catalyst 8200 » Version: N/A
When used together with: Cisco » Catalyst 8300 » Version: N/A
When used together with: Cisco » Catalyst 8300-1n1s-4t2x » Version: N/A
When used together with: Cisco » Catalyst 8300-1n1s-6t » Version: N/A
When used together with: Cisco » Catalyst 8300-2n2s-4t2x » Version: N/A
When used together with: Cisco » Catalyst 8300-2n2s-6t » Version: N/A
When used together with: Cisco » Catalyst 8500 » Version: N/A
When used together with: Cisco » Catalyst 8500-4qc » Version: N/A
When used together with: Cisco » Catalyst 8500l » Version: N/A
When used together with: Cisco » Catalyst 8510csr » Version: N/A
When used together with: Cisco » Catalyst 8510msr » Version: N/A
When used together with: Cisco » Catalyst 8540csr » Version: N/A
When used together with: Cisco » Catalyst 8540msr » Version: N/A
Cisco » Sd-wan
Versions from including (>=) 20.7 and before (<) 20.7.2
cpe:2.3:a:cisco:sd-wan:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Catalyst 8000v Edge » Version: N/A
When used together with: Cisco » Catalyst Cg418-e » Version: N/A
When used together with: Cisco » Catalyst Cg522-e » Version: N/A
When used together with: Cisco » 1100-4g Integrated Services Router » Version: N/A
When used together with: Cisco » 1100-4p Integrated Services Router » Version: N/A
When used together with: Cisco » 1100-6g Integrated Services Router » Version: N/A
When used together with: Cisco » 1100-8p Integrated Services Router » Version: N/A
When used together with: Cisco » 1100 Integrated Services Router » Version: N/A
When used together with: Cisco » 1101-4p Integrated Services Router » Version: N/A
When used together with: Cisco » 1101 Integrated Services Router » Version: N/A
When used together with: Cisco » 1109-2p Integrated Services Router » Version: N/A
When used together with: Cisco » 1109-4p Integrated Services Router » Version: N/A
When used together with: Cisco » 1109 Integrated Services Router » Version: N/A
When used together with: Cisco » 1111x-8p Integrated Services Router » Version: N/A
When used together with: Cisco » 1111x Integrated Services Router » Version: N/A
When used together with: Cisco » 111x Integrated Services Router » Version: N/A
When used together with: Cisco » 1120 Integrated Services Router » Version: N/A
When used together with: Cisco » 1131 Integrated Services Router » Version: N/A
When used together with: Cisco » 1160 Integrated Services Router » Version: N/A
When used together with: Cisco » 4000 Integrated Services Router » Version: N/A
When used together with: Cisco » 4221 Integrated Services Router » Version: N/A
When used together with: Cisco » 4321/k9-rf Integrated Services Router » Version: N/A
When used together with: Cisco » 4321/k9-ws Integrated Services Router » Version: N/A
When used together with: Cisco » 4321/k9 Integrated Services Router » Version: N/A
When used together with: Cisco » 4321 Integrated Services Router » Version: N/A
When used together with: Cisco » 4331/k9-rf Integrated Services Router » Version: N/A
When used together with: Cisco » 4331/k9-ws Integrated Services Router » Version: N/A
When used together with: Cisco » 4331/k9 Integrated Services Router » Version: N/A
When used together with: Cisco » 4331 Integrated Services Router » Version: N/A
When used together with: Cisco » 4351/k9-rf Integrated Services Router » Version: N/A
When used together with: Cisco » 4351/k9-ws Integrated Services Router » Version: N/A
When used together with: Cisco » 4351/k9 Integrated Services Router » Version: N/A
When used together with: Cisco » 4351 Integrated Services Router » Version: N/A
When used together with: Cisco » 4431 Integrated Services Router » Version: N/A
When used together with: Cisco » 4451-x Integrated Services Router » Version: N/A
When used together with: Cisco » 4451 Integrated Services Router » Version: N/A
When used together with: Cisco » 4461 Integrated Services Router » Version: N/A
When used together with: Cisco » 8101-32fh » Version: N/A
When used together with: Cisco » 8101-32h » Version: N/A
When used together with: Cisco » 8102-64h » Version: N/A
When used together with: Cisco » 8201 » Version: N/A
When used together with: Cisco » 8201-32fh » Version: N/A
When used together with: Cisco » 8202 » Version: N/A
When used together with: Cisco » 8804 » Version: N/A
When used together with: Cisco » 8808 » Version: N/A
When used together with: Cisco » 8812 » Version: N/A
When used together with: Cisco » 8818 » Version: N/A
When used together with: Cisco » 8831 » Version: N/A
When used together with: Cisco » Asr 1000 » Version: N/A
When used together with: Cisco » Asr 1000-x » Version: N/A
When used together with: Cisco » Asr 1001 » Version: N/A
When used together with: Cisco » Asr 1001-hx » Version: N/A
When used together with: Cisco » Asr 1001-hx R » Version: N/A
When used together with: Cisco » Asr 1001-x » Version: N/A
When used together with: Cisco » Asr 1001-x R » Version: N/A
When used together with: Cisco » Asr 1002 » Version: N/A
When used together with: Cisco » Asr 1002-hx » Version: N/A
When used together with: Cisco » Asr 1002-hx R » Version: N/A
When used together with: Cisco » Asr 1002-x » Version: N/A
When used together with: Cisco » Asr 1002-x R » Version: N/A
When used together with: Cisco » Asr 1004 » Version: N/A
When used together with: Cisco » Asr 1006 » Version: N/A
When used together with: Cisco » Asr 1006-x » Version: N/A
When used together with: Cisco » Asr 1009-x » Version: N/A
When used together with: Cisco » Asr 1013 » Version: N/A
When used together with: Cisco » Asr 1023 » Version: N/A
When used together with: Cisco » Catalyst 8200 » Version: N/A
When used together with: Cisco » Catalyst 8300 » Version: N/A
When used together with: Cisco » Catalyst 8300-1n1s-4t2x » Version: N/A
When used together with: Cisco » Catalyst 8300-1n1s-6t » Version: N/A
When used together with: Cisco » Catalyst 8300-2n2s-4t2x » Version: N/A
When used together with: Cisco » Catalyst 8300-2n2s-6t » Version: N/A
When used together with: Cisco » Catalyst 8500 » Version: N/A
When used together with: Cisco » Catalyst 8500-4qc » Version: N/A
When used together with: Cisco » Catalyst 8500l » Version: N/A
When used together with: Cisco » Catalyst 8510csr » Version: N/A
When used together with: Cisco » Catalyst 8510msr » Version: N/A
When used together with: Cisco » Catalyst 8540csr » Version: N/A
When used together with: Cisco » Catalyst 8540msr » Version: N/A
Cisco » Sd-wan » Version: 20.8
cpe:2.3:a:cisco:sd-wan:20.8:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Catalyst 8000v Edge » Version: N/A
When used together with: Cisco » Catalyst Cg418-e » Version: N/A
When used together with: Cisco » Catalyst Cg522-e » Version: N/A
When used together with: Cisco » 1100-4g Integrated Services Router » Version: N/A
When used together with: Cisco » 1100-4p Integrated Services Router » Version: N/A
When used together with: Cisco » 1100-6g Integrated Services Router » Version: N/A
When used together with: Cisco » 1100-8p Integrated Services Router » Version: N/A
When used together with: Cisco » 1100 Integrated Services Router » Version: N/A
When used together with: Cisco » 1101-4p Integrated Services Router » Version: N/A
When used together with: Cisco » 1101 Integrated Services Router » Version: N/A
When used together with: Cisco » 1109-2p Integrated Services Router » Version: N/A
When used together with: Cisco » 1109-4p Integrated Services Router » Version: N/A
When used together with: Cisco » 1109 Integrated Services Router » Version: N/A
When used together with: Cisco » 1111x-8p Integrated Services Router » Version: N/A
When used together with: Cisco » 1111x Integrated Services Router » Version: N/A
When used together with: Cisco » 111x Integrated Services Router » Version: N/A
When used together with: Cisco » 1120 Integrated Services Router » Version: N/A
When used together with: Cisco » 1131 Integrated Services Router » Version: N/A
When used together with: Cisco » 1160 Integrated Services Router » Version: N/A
When used together with: Cisco » 4000 Integrated Services Router » Version: N/A
When used together with: Cisco » 4221 Integrated Services Router » Version: N/A
When used together with: Cisco » 4321/k9-rf Integrated Services Router » Version: N/A
When used together with: Cisco » 4321/k9-ws Integrated Services Router » Version: N/A
When used together with: Cisco » 4321/k9 Integrated Services Router » Version: N/A
When used together with: Cisco » 4321 Integrated Services Router » Version: N/A
When used together with: Cisco » 4331/k9-rf Integrated Services Router » Version: N/A
When used together with: Cisco » 4331/k9-ws Integrated Services Router » Version: N/A
When used together with: Cisco » 4331/k9 Integrated Services Router » Version: N/A
When used together with: Cisco » 4331 Integrated Services Router » Version: N/A
When used together with: Cisco » 4351/k9-rf Integrated Services Router » Version: N/A
When used together with: Cisco » 4351/k9-ws Integrated Services Router » Version: N/A
When used together with: Cisco » 4351/k9 Integrated Services Router » Version: N/A
When used together with: Cisco » 4351 Integrated Services Router » Version: N/A
When used together with: Cisco » 4431 Integrated Services Router » Version: N/A
When used together with: Cisco » 4451-x Integrated Services Router » Version: N/A
When used together with: Cisco » 4451 Integrated Services Router » Version: N/A
When used together with: Cisco » 4461 Integrated Services Router » Version: N/A
When used together with: Cisco » 8101-32fh » Version: N/A
When used together with: Cisco » 8101-32h » Version: N/A
When used together with: Cisco » 8102-64h » Version: N/A
When used together with: Cisco » 8201 » Version: N/A
When used together with: Cisco » 8201-32fh » Version: N/A
When used together with: Cisco » 8202 » Version: N/A
When used together with: Cisco » 8804 » Version: N/A
When used together with: Cisco » 8808 » Version: N/A
When used together with: Cisco » 8812 » Version: N/A
When used together with: Cisco » 8818 » Version: N/A
When used together with: Cisco » 8831 » Version: N/A
When used together with: Cisco » Asr 1000 » Version: N/A
When used together with: Cisco » Asr 1000-x » Version: N/A
When used together with: Cisco » Asr 1001 » Version: N/A
When used together with: Cisco » Asr 1001-hx » Version: N/A
When used together with: Cisco » Asr 1001-hx R » Version: N/A
When used together with: Cisco » Asr 1001-x » Version: N/A
When used together with: Cisco » Asr 1001-x R » Version: N/A
When used together with: Cisco » Asr 1002 » Version: N/A
When used together with: Cisco » Asr 1002-hx » Version: N/A
When used together with: Cisco » Asr 1002-hx R » Version: N/A
When used together with: Cisco » Asr 1002-x » Version: N/A
When used together with: Cisco » Asr 1002-x R » Version: N/A
When used together with: Cisco » Asr 1004 » Version: N/A
When used together with: Cisco » Asr 1006 » Version: N/A
When used together with: Cisco » Asr 1006-x » Version: N/A
When used together with: Cisco » Asr 1009-x » Version: N/A
When used together with: Cisco » Asr 1013 » Version: N/A
When used together with: Cisco » Asr 1023 » Version: N/A
When used together with: Cisco » Catalyst 8200 » Version: N/A
When used together with: Cisco » Catalyst 8300 » Version: N/A
When used together with: Cisco » Catalyst 8300-1n1s-4t2x » Version: N/A
When used together with: Cisco » Catalyst 8300-1n1s-6t » Version: N/A
When used together with: Cisco » Catalyst 8300-2n2s-4t2x » Version: N/A
When used together with: Cisco » Catalyst 8300-2n2s-6t » Version: N/A
When used together with: Cisco » Catalyst 8500 » Version: N/A
When used together with: Cisco » Catalyst 8500-4qc » Version: N/A
When used together with: Cisco » Catalyst 8500l » Version: N/A
When used together with: Cisco » Catalyst 8510csr » Version: N/A
When used together with: Cisco » Catalyst 8510msr » Version: N/A
When used together with: Cisco » Catalyst 8540csr » Version: N/A
When used together with: Cisco » Catalyst 8540msr » Version: N/A
Cisco » Sd-wan Vbond Orchestrator
Versions from including (>=) 20.6 and before (<) 20.6.3
cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:*:*:*:*:*:*:*:*
Matching versions
Cisco » Sd-wan Vbond Orchestrator
Versions from including (>=) 20.7 and before (<) 20.7.2
cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:*:*:*:*:*:*:*:*
Matching versions
Cisco » Sd-wan Vbond Orchestrator » Version: 20.8
cpe:2.3:a:cisco:sd-wan_vbond_orchestrator:20.8:*:*:*:*:*:*:*
Matching versions
Cisco » Sd-wan Vsmart Controller
Versions from including (>=) 20.6 and before (<) 20.6.3
cpe:2.3:a:cisco:sd-wan_vsmart_controller:*:*:*:*:*:*:*:*
Matching versions
Cisco » Sd-wan Vsmart Controller
Versions from including (>=) 20.7 and before (<) 20.7.2
cpe:2.3:a:cisco:sd-wan_vsmart_controller:*:*:*:*:*:*:*:*
Matching versions
Cisco » Sd-wan Vsmart Controller » Version: 20.8
cpe:2.3:a:cisco:sd-wan_vsmart_controller:20.8:*:*:*:*:*:*:*
Matching versions
Cisco » Catalyst Sd-wan Manager
Versions from including (>=) 20.7 and before (<) 20.7.2
cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*
Matching versions
Cisco » Catalyst Sd-wan Manager
Versions from including (>=) 20.6 and before (<) 20.6.3
cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*
Matching versions
Cisco » Catalyst Sd-wan Manager » Version: 20.8
cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.8:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2022-20775

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-20775

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.8	HIGH	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	Cisco Systems, Inc.
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2022-20775

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Assigned by: nvd@nist.gov (Primary)
CWE-25 Path Traversal: '/../filedir'

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "/../" sequences that can resolve to a location that is outside of that directory.

Assigned by: ykramarz@cisco.com (Secondary)

References for CVE-2022-20775

https://github.com/orangecertcc/security-research/security/advisories/GHSA-wmjv-552v-pxjc

Path Traversal in SD-WAN vEdge (x86 and mips64) routers (CVE-2022-20775) · Advisory · orangecertcc/security-research · GitHub
Exploit;Third Party Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF

Cisco SD-WAN Software Privilege Escalation Vulnerabilities
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2022-20775

Products affected by CVE-2022-20775

Exploit prediction scoring system (EPSS) score for CVE-2022-20775

CVSS scores for CVE-2022-20775

CWE ids for CVE-2022-20775

References for CVE-2022-20775