CVE-2022-20775: Cisco SD‑WAN Path Traversal Vulnerability Allows Authenticated Privilege Escalation
What It Is – Cisco SD‑WAN’s command‑line interface contains a path‑traversal flaw that lets an attacker who already has local, authenticated access to the device read or write files outside the intended directory tree. By abusing this weakness, the adversary can execute arbitrary commands with root privileges.
Exploitability – The vulnerability is authentic‑local‑only; no public exploit code is known, but an attacker who gains a foothold on the appliance can leverage it to elevate privileges. The CVSS v3.1 base score is 9.8 (Critical).
Affected Products – Cisco SD‑WAN (vEdge routers, vManage controllers, and any appliance running the vulnerable CLI version).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous control mapping: the gap between intended least‑privilege design and actual CLI access must be documented and monitored.
- Provides a concrete evidence point for auditors—showing that privileged‑access controls are enforced, logged, and can be verified against the Verisq Common Framework (VCF) control “Access Control Management.”
- Highlights the importance of defensible audit trails; without proper logging of privileged commands, organizations cannot prove due diligence when a breach investigation occurs.
Recommended Actions
- Apply Cisco’s security patch for CVE‑2022‑20775 immediately.
- Review and harden CLI access controls: enforce role‑based permissions, disable unnecessary local accounts, and require multi‑factor authentication for privileged sessions.
- Enable comprehensive command‑logging and forward logs to a centralized SIEM for continuous monitoring.
- Map the remediation steps to the VCF “Access Control Management” objective and capture evidence in your Trust Center for audit readiness.
Source: CISA KEV – CVE‑2022‑20775