CVE-2022-20716: Cisco SD-WAN Solution Improper Access Control Vulnerability

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-04-15 · updated 2026-06-17
Weakness: CWE-284

Description

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain escalated privileges. This vulnerability is due to improper access control on files within the affected system. A local attacker could exploit this vulnerability by modifying certain files on the vulnerable device. If successful, the attacker could gain escalated privileges and take actions on the system with the privileges of the root user.

Affected products

Cisco Catalyst SD-WAN Manager: all versions
Cisco Sd-Wan: from 18.4 before 20.6.1; from 20.7 before 20.7.1 — fixed in 20.6.1, 20.7.1
Cisco Sd-Wan Solution: all versions
Cisco Sd-Wan Vbond Orchestrator: all versions
Cisco Sd-Wan Vedge Cloud: all versions
Cisco SD-WAN vEdge router: all versions
Cisco Sd-Wan Vsmart Controller Software: all versions

How to fix

Upgrade to a fixed version: Cisco Sd-Wan 20.6.1, 20.7.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-20716 or the next vulnerability affects your stack