PT-2025-20259 · Cisco · Cisco Catalyst Sd-Wan Manager

Published 2025-05-07 · Updated 2025-08-04 · CVE-2025-20187

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Cisco Catalyst SD-WAN Manager versions (affected versions not specified)

Description A vulnerability in the application data endpoints could allow an authenticated, remote attacker to write arbitrary files to an affected system. This issue is due to improper validation of requests to APIs. An attacker could exploit this by sending malicious requests to an API within the affected system, potentially conducting directory traversal attacks and writing files to arbitrary locations.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2025-05710

CVE-2025-20187

Affected Products

Cisco Catalyst Sd-Wan Manager

References · 6

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwanarbfile-2zKhKZwJ · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-20187 · Security Note
• https://osv.dev/vulnerability/CVE-2025-20187 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-05710 · Security Note
• https://twitter.com/CVEnew/status/1920246424324710521 · Twitter Post
• https://t.me/cveNotify/130776 · Telegram Post