CVE-2022-20775

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2022-20775 7.8

Cisco · SD-WAN · Added 2026-02-25 · Published 2022-09-30

3-Day Required PoC Available KEV Active Exploitation

Details

VulnerabilityCisco SD-WAN Path Traversal Vulnerability

VendorCisco

ProductSD-WAN

Date added2026-02-25

Due date2026-02-27

CISA catalogView on CISA KEV catalog

Required actionPlease adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

CWECWE-22 CWE-25

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Cisco SD-WAN CLI contains a path traversal vulnerability that could allow an authenticated local attacker to gain elevated privileges via improper access controls on commands within the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user.

NVD: A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. This vulnerability is due to improper access controls on commands within the application CLI. An attacker could exploit this vulnerability by running a maliciously crafted command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF

Compliance SSVC + BOD 26-04

Automatableno

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline14 days

Forensic (public)Required

Forensic (non-public)Not required

Research metadata

Last researched2026-08-28 18:41 UTC

Wall time52.8s

Searches8

Component defaultyes

Sources https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF
https://nvd.nist.gov/vuln/detail/CVE-2022-20775
https://github.com/orangecertcc/security-research/security/advisories/GHSA-wmjv-552v-pxjc
https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems
https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems
https://www.sophos.com/en-us/blog/cisco-sd-wan-vulnerabilities-cve-2026-20127-cve-2022-20775-in-active-exploitation
https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-sd-wan-priv-E6e8tEdF.html
https://www.tenable.com/plugins/nessus/165534

QC notes

warn component_extraction: Component 'confd_cli_grp SUID binary (Viptela CLI) on Cisco SD-WAN vEdge Routers (x86 and mips64) — path traversal in group membership file lookup via USER environment variable' matches or contains product name 'SD-WAN' — no specific component identified

Hunting hypothesis agent

Hunt vEdge router logs for confd_cli_grp execution with USER env containing path traversal (e.g., /../../), correlated with symlinks at /tmp/*.external targeting /etc/viptela/confd_ipc_secret and uid=0 sessions spawned from non-root users.

Research details

Componentconfd_cli_grp SUID binary (Viptela CLI) on Cisco SD-WAN vEdge Routers (x86 and mips64) — path traversal in group membership file lookup via USER environment variable

PreconditionsAuthenticated local access to Cisco SD-WAN vEdge CLI via restricted vshell; ability to set USER environment variable and create symlinks in /tmp; target must run vulnerable SD-WAN Software release (prior to 20.6.3, 20.7.2, or 20.8.1); applies to vBond, vEdge Cloud, vEdge Routers, vManage, and vSmart Controller running Viptela software agent

DeliveryAuthenticated local attacker accesses the restricted vshell on a Cisco SD-WAN vEdge router. The attacker sets USER=/../../../../tmp/pwn environment variable and creates a symlink /tmp/pwn.external -> /etc/viptela/confd_ipc_secret. When confd_cli_grp (SUID binary) runs, it reads the secret file via the path traversal, sending the secret to confd. An attacker-in-the-middle on CONFD_IPC_PORT captures the secret, forges a session configuration with uid=0/gid=0, and establishes a root-privileged CLI session, resulting in full system compromise.

Public PoCyes

PoC URLs https://github.com/orangecertcc/security-research/security/advisories/GHSA-wmjv-552v-pxjc Third-party repos; verify before use.

Advisoryhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF

Exploit notesCVSS attack complexity: LOW. Full public PoC available from Orange CERT-CC (Cyrille Chatras) via GitHub advisory. Exploit technique: path traversal via USER=/../../../../tmp/pwn in confd_cli_grp SUID binary to leak confd_ipc_secret, then use Man-in-the-Middle attack on confd IPC channel to forge session with uid=0/gid=0 for root shell. Tested on vEdge 20.6.1 and 20.6.2 on x86 and mips64. Fixed in 20.6.3, 20.7.2, 20.8.1. Cisco bug IDs: CSCwa52793, CSCwb54198. HIGH severity (CVSS 7.0–8.9).

SummaryCVE-2022-20775 is a path traversal (CWE-25/CWE-22) vulnerability in the confd_cli_grp SUID binary on Cisco SD-WAN vEdge routers (Viptela software). The binary constructs a file path by concatenating /etc/viptela/aaa_auth_grp/ with the USER environment variable and .external extension without sanitizing '../' sequences. An authenticated local attacker can set USER=/../../../../tmp/pwn to read arbitrary files via symlink. The exploit leaks confd_ipc_secret, then forges a privileged confd session with uid=0/gid=0, achieving root shell. Reported by Cyrille Chatras (Orange CERT-CC) on Dec 16, 2021. Fixed Sep 28, 2022. In Feb 2026, Cisco PSIRT confirmed active exploitation attempts. CISA issued Emergency Directive 26-03 on Feb 25, 2026 requiring FCEB agencies to inventory, patch, and hunt for compromise. The vulnerability is part of an exploitation chain with CVE-2026-20127 (auth bypass for initial access).

Tia coverage

First reported2026-05-15

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cisco-sd-wan-zero-day-cve-2026-20182-6th-exploited-flaw-in-2026

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.