CVE-2022-20775 (Cisco SD-WAN Path Traversal)

What this vulnerability means in Cisco SD-WAN

Path traversal in a management interface is dangerous because it can let a user reach files, paths, or functions that the application should not expose. In Cisco SD-WAN CLI, the issue matters because the abuse path sits inside an administrative control plane, where a successful bypass can have far broader consequences than a normal application bug.

For security teams, the key question is not just whether the product is deployed, but whether the affected management surface is exposed in a way that an authenticated local attacker could reach it. That makes the vulnerability a control-plane integrity problem as much as a software flaw.

Why path traversal in a CLI is high impact

Path traversal is often associated with file disclosure, but in administrative software it can also become a privilege boundary problem. If command handlers, file references, or internal paths are insufficiently constrained, an attacker may reach resources or operations that were meant to stay behind higher privilege checks.

Because the issue occurs in the CLI rather than a public-facing content path, the practical danger is often underestimated. Administrative tools are trusted to enforce policy correctly, so weaknesses in command access controls can undermine the entire management plane once an attacker has an initial foothold.

How organisations assess exposure and exposure path

Exposure starts with inventory: confirm where Cisco SD-WAN components are deployed, which management interfaces are enabled, and which operators or automation paths can access the CLI. Teams should also review whether the affected interface is reachable only from tightly controlled admin networks or whether it is more broadly exposed through remote management paths.

Vendor advisories and the CISA Known Exploited Vulnerabilities catalogue are the authoritative sources for version-specific action, while the NIST National Vulnerability Database and the CVE Program provide the canonical record for the vulnerability itself. For broader patch-triage workflows, Vulnerability Management Guide is useful because it places KEV-listed issues into a remediation and verification process rather than treating them as isolated tickets.

Remediation, detection, and compromise review

Remediation should focus on removing the vulnerable condition, restricting access to the management plane, and reducing the blast radius until patching is complete. Where immediate remediation is not possible, compensating controls include limiting administrative reachability, tightening local privilege paths, and monitoring for abnormal CLI activity.

Detection should look for unusual local logins, unexpected command patterns, and signs that an authenticated user has attempted to step outside intended file or command boundaries. After patching, review administrative sessions, configuration changes, and related logs for evidence of prior exploitation, because a fix does not by itself prove the device was never accessed.

If compromise is suspected, review whether any administrator credentials, sessions, API tokens, or automation secrets were available on or through the affected management system and rotate them as needed. That step matters because management-plane compromise often creates a second-order identity problem even when the original flaw is a software vulnerability.

Risk and Threat Considerations

When a path traversal bug sits in a management CLI, the main risk is not just disclosure, but abuse of trust inside the control plane. An attacker with valid local access may be able to use the flaw to reach higher-privilege functions, alter configuration, or pivot into adjacent management capabilities.

Failure mechanism: Improper access controls on command handling allow a local authenticated user to bypass intended path restrictions and gain privileges that the CLI should not grant.

Impact: The attacker can potentially change device behaviour, weaken network segmentation, or use the management plane as a stepping stone for broader compromise.

Practitioner Guidance

What to watch for: Treat KEV-listed management-plane issues as operationally urgent, especially where the vulnerable service is reachable from shared admin networks or automation hosts. Even if the product is not internet-facing, a local foothold on a trusted system can be enough to turn an application flaw into a control-plane compromise.

Practitioner takeaway: For SD-WAN and similar infrastructure software, the safest assumption is that administrative bugs can become network-wide incidents, so exposure review, patch validation, and post-fix compromise checks should move together.

Related resources from NHI Mgmt Group

• CVE-2026-20128 (Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format)
• CVE-2026-76519 (Cisco Secure Email Gateway Relative Path Traversal)
• CVE-2026-20133 (Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor)
• CVE-2024-13161 (Ivanti Endpoint Manager (EPM) Absolute Path Traversal)