CVE-2022-20775

What it actually does

This is an authenticated local privilege-escalation vulnerability in the Cisco SD-WAN Software CLI. Improper access controls on CLI commands allow a user who already has local CLI access to run a crafted command that escapes the intended privilege boundary and executes arbitrary operating-system commands as root. Successful exploitation gives the attacker full control of the affected SD-WAN component, including confidentiality, integrity, and availability impact.

Why it matters to the business

Compromise of SD-WAN control or edge infrastructure can disrupt branch connectivity, alter routing behavior, expose sensitive network configuration, and provide a foothold for broader network intrusion. Because this vulnerability is listed in CISA KEV and marked as actively exploited in the wild, affected organizations should treat remediation as urgent, with the KEV remediation deadline of 2026-02-27 as the latest acceptable date for covered environments.

How an attack unfolds

An attacker first obtains valid low-privileged access to the affected Cisco SD-WAN device or controller CLI, commonly through stolen credentials, insider access, weak administrative separation, or prior compromise of an account with CLI access. The attacker then submits a specially crafted CLI command that abuses improper command access controls. Instead of being constrained to the permitted CLI role, the command is executed by the underlying system with root privileges. With root access, the attacker can modify system files, create persistence, alter SD-WAN configuration, tamper with logs, collect credentials or keys, and use the device as a trusted pivot point into the wider network. Public reporting indicates active exploitation, so detection should assume that valid credentials and interactive CLI access may have been used rather than relying only on unauthenticated exploit signatures.

How to fix it

Apply the Cisco software updates that address this vulnerability for all affected Cisco SD-WAN components and platforms, including SD-WAN Manager/vManage, vBond Orchestrator, vSmart Controller, vEdge Cloud, Catalyst 8000V Edge, Catalyst CG platforms, and affected ISR platforms. Cisco states that there are no workarounds that fully address this vulnerability. Where exact fixed versions are not already standardized internally, use the Cisco advisory and Cisco Software Checker to identify the fixed release for each deployed train and upgrade accordingly. Until upgrades are complete, reduce exposure by limiting CLI access to trusted administrators only, enforcing MFA and centralized AAA where supported, restricting SSH/management access to dedicated management networks, reviewing TACACS+/RADIUS command accounting, disabling unused local accounts, and monitoring all CLI activity closely.

How to confirm the fix worked

Confirm exposure by inventorying all Cisco SD-WAN appliances, controllers, and virtual instances and comparing their installed software versions against Cisco’s fixed-release guidance. Validate that upgraded systems report a fixed version after reboot or service restart and that no devices remain on vulnerable release trains. Confirm administrative access controls by verifying that only approved users can reach the CLI over SSH or console and that AAA command accounting is enabled where available. For assurance, review post-upgrade logs for failed or blocked attempts to invoke restricted shell or root-level commands; avoid running weaponized proof-of-concept commands in production.

Typical attack path

1. Obtain valid credentials or an authorized local/CLI session to an affected Cisco SD-WAN component.
2. Access the appliance or controller CLI through SSH, console, or another administrative path.
3. Run a crafted CLI command that bypasses intended command access controls.
4. Achieve arbitrary command execution as the root user on the underlying operating system.
5. Establish persistence, modify configuration, collect secrets, or deploy additional tooling.
6. Use the compromised SD-WAN device to disrupt service, monitor traffic, or pivot further into the network.

How to detect it

To determine whether this was already exploited, review device CLI, SSH, AAA, and system logs for successful low-privileged logins followed by root-level command execution, restricted shell escapes, unusual command failures, or sudden privilege changes. Correlate Cisco SD-WAN administrative events with TACACS+/RADIUS accounting to identify commands executed by each user. Examine system logs for unexpected root shells, sudo/su activity, process launches from the CLI, or commands executed from temporary paths. Perform file-system and configuration review for new local users, modified SSH authorized_keys files, altered sudoers or startup scripts, cron jobs, unexpected binaries in /tmp or /var/tmp, and log tampering. Also inspect SD-WAN Manager and controller audit records for unauthorized configuration changes, route or policy updates, template modifications, or device reboots around suspicious sessions. Because exploitation requires authenticated local access, credential misuse and legitimate administrative channels may be the primary evidence rather than a network exploit signature.

• session opened for user root
• COMMAND=
• USER=root
• uid=0
• sudo:
• su:
• authentication failure
• Accepted password
• Accepted publickey
• Failed password
• /var/log/auth.log
• /var/log/secure
• /var/log/messages
• /var/log/syslog
• /root/.ssh/authorized_keys
• /etc/sudoers
• /etc/passwd
• /etc/shadow
• /etc/crontab
• /var/spool/cron
• /tmp/
• /var/tmp/
• bash -c
• sh -c
• nc -e
• ncat -e
• wget http
• curl http
• chmod +x

What your security team should do

• Prioritize patching affected Cisco SD-WAN control-plane and edge devices because the vulnerability is in CISA KEV and has active in-the-wild exploitation.
• Inventory all affected Cisco SD-WAN products and map each device to the Cisco-advised fixed release for its software train.
• Restrict CLI and SSH access to dedicated management networks, privileged administrator groups, and jump hosts only.
• Review local users, TACACS+/RADIUS accounts, and recently changed administrative privileges for signs of credential misuse.
• Enable and retain AAA accounting, CLI command logging, SSH logs, and system logs for affected devices and forward them to centralized monitoring.
• Hunt for unexpected root sessions, shell escapes, new users, modified startup scripts, cron entries, SSH keys, and suspicious files in temporary directories.
• After patching, rotate credentials and keys for accounts that had CLI access if exploitation is suspected.
• Monitor for configuration drift or unauthorized SD-WAN policy, route, tunnel, or template changes following suspicious CLI activity.