CVE-2022-20775

Name of the Vulnerable Software and Affected Versions Cisco SD-WAN Software (affected versions not specified) Cisco SD-WAN vBond Orchestrator Cisco SD-WAN vEdge Cloud Routers Cisco SD-WAN vEdge Routers Cisco SD-WAN vSmart Controller Cisco SD-WAN vManage

Description A flaw exists in the Command Line Interface (CLI) of Cisco SD-WAN Software that could allow an authenticated, local attacker to gain elevated privileges. This is due to insufficient access controls on commands within the application CLI. An attacker could exploit this by executing a malicious command on the CLI, potentially allowing them to execute arbitrary commands as the root user. The vulnerability involves incorrect restriction of the path name to an access-restricted directory.

Recommendations Update to a newer version of Cisco SD-WAN Software that addresses this vulnerability.