Cisco SD-WAN Path Traversal and Root Privilege Escalation

Historical catalog analysis: CISA added this entry on February 25, 2026. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2022-20775 is a path traversal vulnerability located within the application command-line interface (CLI) of Cisco SD-WAN. The flaw stems from improper access controls on specific commands, which could allow an attacker who already has authenticated local access to bypass intended restrictions. If successfully exploited, this vulnerability enables the attacker to execute arbitrary commands with root-level privileges.

Exposure and applicability

This vulnerability is applicable to healthcare organizations utilizing Cisco SD-WAN infrastructure to manage connectivity across clinical sites, campuses, or remote clinics. Because SD-WAN controllers and edges often facilitate the movement of electronic protected health information (ePHI) between facilities, a compromise at the root level could grant an attacker significant control over network traffic and management functions.

It is important to note that this is not a remote, unauthenticated exploit; it requires the attacker to already possess authenticated local access to the CLI. However, for healthcare security leaders, this represents a critical risk in scenarios involving insider threats or situations where a lower-privileged account has been compromised.

Remediation priorities

Based on our analysis of the vulnerability and CISA’s guidance, we recommend the following prioritized actions for healthcare IT and clinical engineering teams:

1. Review Access Controls: Audit all accounts with CLI access to Cisco SD-WAN devices. Reducing the number of users with authenticated local access could reduce the likelihood of an attacker reaching the vulnerable interface.
2. Implement CISA Hardening Guidance: We recommend reviewing the “Hunt & Hardening Guidance for Cisco SD-WAN Devices” and Emergency Directive 26-03 provided by CISA to identify indicators of compromise and apply recommended system hardening.
3. Coordinate Patching with Clinical Engineering: Ensure that updates to network infrastructure are coordinated with clinical engineering to prevent unplanned downtime of critical patient care systems or medical device connectivity.

How to validate remediation

To verify that exposure has been reduced, security teams should perform the following:

• Privilege Audit: Review current user roles and permissions within the SD-WAN environment to ensure the principle of least privilege is applied, limiting who can access the application CLI.
• Configuration Verification: Compare current device configurations against the hardening benchmarks outlined in CISA’s supplemental guidance for Cisco SD-WAN devices.

Note that verifying a version number alone does not guarantee security, as configuration errors or existing compromises may persist regardless of the software version.

Limits and open questions

While this vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog, it remains unknown whether specific ransomware campaigns have utilized this flaw. Additionally, while CISA has established a due date for federal agencies to mitigate this risk, that specific deadline does not automatically apply to private healthcare providers, though the technical risk remains identical.

Residual risk persists if authenticated local access is granted to untrusted parties or if administrative credentials are leaked, as these conditions satisfy the primary requirement for exploitation.

Source and editorial note

CVE-2022-20775: Cisco SD-WAN Path Traversal Vulnerability · Source date: February 25, 2026 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: February 28, 2026. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 17, 2026 at 01:16 UTC.

Request a healthcare security assessment