Root command execution via CLI path traversal
Published Sep 30, 2022 · Updated Mar 2, 2026
Path traversal in Cisco SD-WAN Software allows local users with restricted-shell access to execute arbitrary commands as root. confd_cli_grp builds an authentication-group pathname from the attacker-controlled USER environment variable without neutralizing ../ sequences, allowing a symlinked file to expose confd_ipc_secret. An authenticated local account that can enter vshell can use the leaked secret to forge a uid=0, gid=0 confd session and obtain an unconstrained root shell.
CVSS severity7.8
HighEPSS probability12.47%
Next 30 days · Sep 16, 2026Known exploitationReported
Based on sourced intelligenceHinoki checkNot available
Coverage for this vulnerabilitySummary
What happened
Path traversal in Cisco SD-WAN Software allows local users with restricted-shell access to execute arbitrary commands as root. confd_cli_grp builds an authentication-group pathname from the attacker-controlled USER environment variable without neutralizing ../ sequences, allowing a symlinked file to expose confd_ipc_secret. An authenticated local account that can enter vshell can use the leaked secret to forge a uid=0, gid=0 confd session and obtain an unconstrained root shell.
The record
- CVE
- CVE-2022-20775
- Published
- Sep 30, 2022
- Updated
- Mar 2, 2026
- Vendor
- ClamAV
- Product
- Cisco SD-WAN vContainer
- Classifications
- CWE-25, T1068
- Attack vector
- local
- Privileges
- authenticated
Timeline
How it unfolded
- Sep 30, 2022CVE publishedPublication date reported by the CVE source.
- Feb 1, 2026Exploitation reportedCisco PSIRT attempted-exploitation observation
- Feb 25, 2026Exploitation reportedCISA Known Exploited Vulnerabilities listing
- Mar 2, 2026Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=17.2.10
- Affected versionversion=17.2.4
- Affected versionversion=17.2.5
- Affected versionversion=17.2.6
- Affected versionversion=17.2.7
- Affected versionversion=17.2.8
- Affected versionversion=17.2.9
- Affected versionversion=18.2.0
- Affected versionversion=18.3.0
- Affected versionversion=18.3.1
- Affected versionversion=18.3.3
- Affected versionversion=18.3.4
- Affected versionversion=18.3.5
- Affected versionversion=18.3.6
- Affected versionversion=18.3.7
- Affected versionversion=18.3.8
- Affected versionversion=18.4.0
- Affected versionversion=18.4.1
- Affected versionversion=18.4.3
- Affected versionversion=18.4.302
- Affected versionversion=18.4.303
- Affected versionversion=18.4.4
- Affected versionversion=18.4.5
- Affected versionversion=19.1.0
- Affected versionversion=19.2.0
- Affected versionversion=19.2.097
- Affected versionversion=19.2.098
- Affected versionversion=19.2.099
- Affected versionversion=19.2.1
- Affected versionversion=19.2.2
- Affected versionversion=19.2.3
- Affected versionversion=19.3.0
- Affected versionversion=20.1.1
- Affected versionversion=20.1.12
- Affected versionversion=20.1.2
- Affected versionversion=20.3.1
What conditions does exploitation require?
Attack vectorlocal
Required privilegesauthenticated
What is affected?
ClamAV · Cisco SD-WAN vContainerversion=17.2.10; version=17.2.4; version=17.2.5; version=17.2.6; version=17.2.7; version=17.2.8; version=17.2.9; version=18.2.0; version=18.3.0; version=18.3.1; version=18.3.3; version=18.3.4; version=18.3.5; version=18.3.6; version=18.3.7; version=18.3.8; version=18.4.0; version=18.4.1; version=18.4.3; version=18.4.302; version=18.4.303; version=18.4.4; version=18.4.5; version=19.1.0; version=19.2.0; version=19.2.097; version=19.2.098; version=19.2.099; version=19.2.1; version=19.2.2; version=19.2.3; version=19.3.0; version=20.1.1; version=20.1.12; version=20.1.2; version=20.3.1
ClamAV · Cisco SD-WAN vEdge Routerversion=17.2.10; version=17.2.4; version=17.2.5; version=17.2.6; version=17.2.7; version=17.2.8; version=17.2.9; version=18.2.0; version=18.3.0; version=18.3.1; version=18.3.3; version=18.3.4; version=18.3.5; version=18.3.6; version=18.3.7; version=18.3.8; version=18.4.0; version=18.4.1; version=18.4.3; version=18.4.302; version=18.4.303; version=18.4.4; version=18.4.5; version=18.4.6; version=19.0.0; version=19.0.1a; version=19.1.0; version=19.1.01; version=19.2.0; version=19.2.097; version=19.2.098; version=19.2.099; version=19.2.1; version=19.2.2; version=19.2.3; version=19.2.31; version=19.2.32; version=19.2.4; version=19.2.929; version=19.3.0; version=20.1.1; version=20.1.11; version=20.1.12; version=20.1.2; version=20.1.3; version=20.3.1; version=20.3.2; version=20.3.3; version=20.3.3.2; version=20.3.4; version=20.3.4.3; version=20.3.5; version=20.3.5.1; version=20.3.6; version=20.3.7; version=20.3.7.1; version=20.3.7.2; version=20.3.8; version=20.4.1; version=20.4.1.1; version=20.4.1.2; version=20.4.2; version=20.5.1; version=20.6.1; version=20.6.1.2; version=20.6.2; version=20.6.3; version=20.6.3.2; version=20.6.3.3; version=20.6.4; version=20.6.4.1; version=20.6.5; version=20.6.5.1; version=20.6.5.2; version=20.6.5.3; version=20.6.5.4; version=20.6.6; version=20.6.7; version=20.6.8; version=20.7.1; version=20.7.1.2; version=20.7.2
ClamAV · Cisco Catalyst SD-WANversion=17.2.10; version=17.2.1LA; version=17.2.4; version=17.2.5; version=17.2.6; version=17.2.7; version=17.2.8; version=17.2.9; version=17.3.1ESM1; version=17.3.1ESM2; version=17.3.1ESM3; version=17.3.2ESM1; version=17.3.2ESM2; version=17.3.2ESM3; version=17.4.2.2527; version=17.4.2ES1; version=18.2.0; version=18.3.0; version=18.3.1; version=18.3.3; version=18.3.3.1; version=18.3.4; version=18.3.5; version=18.3.6; version=18.3.7; version=18.3.8; version=18.4.0; version=18.4.0.1; version=18.4.1; version=18.4.3; version=18.4.302; version=18.4.303; version=18.4.4; version=18.4.5; version=18.4.6; version=19.0.0; version=19.1.0; version=19.1.0a; version=19.2.0; version=19.2.097; version=19.2.098; version=19.2.099; version=19.2.1; version=19.2.2; version=19.2.3; version=19.2.31; version=19.2.32; version=19.2.4; version=19.2.929; version=19.3.0; version=20.1.1; version=20.1.11; version=20.1.1.1; version=20.1.12; version=20.1.2; version=20.1.3; version=20.1.3.1; version=20.3.1; version=20.3.2; version=20.3.2.1; version=20.3.3; version=20.3.3.1; version=20.3.3.2; version=20.3.4; version=20.3.4.1; version=20.3.4.2; version=20.3.4.3; version=20.3.5; version=20.3.5.1; version=20.3.6; version=20.3.7; version=20.3.7.1; version=20.3.7.2; version=20.3.8; version=20.3.809; version=20.3.811; version=20.4.1; version=20.4.1.1; version=20.4.1.2; version=20.4.2; version=20.4.2.1; version=20.4.2.2; version=20.4.2.3; version=20.5.1; version=20.5.1.1; version=20.5.1.2; version=20.6.1; version=20.6.1.1; version=20.6.1.2; version=20.6.2; version=20.6.2.1; version=20.6.2.2; version=20.6.3; version=20.6.3.1; version=20.6.3.2; version=20.6.3.3; version=20.6.3.4; version=20.6.4; version=20.6.4.1; version=20.6.4.2; version=20.6.5; version=20.6.5.1; version=20.6.5.2; version=20.6.5.3; version=20.6.5.4; version=20.6.5.5; version=20.6.6; version=20.6.7; version=20.6.8; version=20.7.1; version=20.7.1.1; version=20.7.2
ClamAV · Cisco SD-WAN vEdge Cloudversion=17.2.10; version=17.2.4; version=17.2.5; version=17.2.6; version=17.2.7; version=17.2.8; version=17.2.9; version=18.2.0; version=18.3.0; version=18.3.1; version=18.3.3; version=18.3.4; version=18.3.5; version=18.3.6; version=18.3.7; version=18.3.8; version=18.4.0; version=18.4.1; version=18.4.3; version=18.4.302; version=18.4.303; version=18.4.4; version=18.4.5; version=18.4.6; version=19.0.1a; version=19.1.0; version=19.2.0; version=19.2.097; version=19.2.098; version=19.2.099; version=19.2.1; version=19.2.2; version=19.2.3; version=19.2.31; version=19.2.32; version=19.2.4; version=19.2.929; version=19.3.0; version=20.1.1; version=20.1.12; version=20.1.2; version=20.1.3; version=20.1.3.1; version=20.3.1; version=20.3.2; version=20.3.3; version=20.3.3.2; version=20.3.4; version=20.3.4.3; version=20.3.5; version=20.3.5.1; version=20.3.6; version=20.3.7; version=20.3.7.1; version=20.3.7.2; version=20.3.8; version=20.4.1; version=20.4.1.1; version=20.4.1.2; version=20.4.2; version=20.4.2.3; version=20.5.1; version=20.6.1; version=20.6.1.2; version=20.6.2; version=20.6.3; version=20.6.3.2; version=20.6.3.3; version=20.6.4; version=20.6.4.1; version=20.6.5; version=20.6.5.2; version=20.6.5.3; version=20.6.5.4; version=20.6.6; version=20.6.7; version=20.6.8; version=20.7.1; version=20.7.2
ClamAV · Cisco Catalyst SD-WAN Managerversion=17.2.10; version=17.2.4; version=17.2.5; version=17.2.6; version=17.2.7; version=17.2.8; version=17.2.9; version=18.2.0; version=18.3.0; version=18.3.1; version=18.3.1.1; version=18.3.3; version=18.3.3.1; version=18.3.4; version=18.3.5; version=18.3.6; version=18.3.6.1; version=18.3.7; version=18.3.8; version=18.4.0; version=18.4.0.1; version=18.4.1; version=18.4.3; version=18.4.302; version=18.4.303; version=18.4.4; version=18.4.5; version=18.4.501_ES; version=18.4.6; version=19.0.0; version=19.0.1a; version=19.1.0; version=19.2.0; version=19.2.097; version=19.2.098; version=19.2.099; version=19.2.1; version=19.2.2; version=19.2.3; version=19.2.31; version=19.2.32; version=19.2.4; version=19.2.4.0.1; version=19.2.4.0.8; version=19.2.4.0.9; version=19.2.929; version=19.3.0; version=20.1.1; version=20.1.1.1; version=20.1.12; version=20.1.2; version=20.1.2_937; version=20.1.3; version=20.3.1; version=20.3.2; version=20.3.2.0.5; version=20.3.2.0.6; version=20.3.2.1; version=20.3.2.1_927; version=20.3.2.1_930; version=20.3.2_925; version=20.3.2_928; version=20.3.2_929; version=20.3.2_937; version=20.3.3; version=20.3.3.0.14; version=20.3.3.0.16; version=20.3.3.0.17; version=20.3.3.0.18; version=20.3.3.0.2; version=20.3.3.0.4; version=20.3.3.0.8; version=20.3.3.1; version=20.3.3.1.1; version=20.3.3.1.10; version=20.3.3.1.2; version=20.3.3.1.5; version=20.3.3.1.7; version=20.3.3.2; version=20.3.4; version=20.3.4.0.1; version=20.3.4.0.11; version=20.3.4.0.19; version=20.3.4.0.20; version=20.3.4.0.24; version=20.3.4.0.25; version=20.3.4.0.26; version=20.3.4.0.5; version=20.3.4.0.6; version=20.3.4.0.9; version=20.3.4.1; version=20.3.4.1.1; version=20.3.4.1.2; version=20.3.4.2; version=20.3.4.2.1; version=20.3.4.2.2; version=20.3.4.3; version=20.3.5; version=20.3.5.0.7; version=20.3.5.0.8; version=20.3.5.0.9; version=20.3.5.1; version=20.3.6; version=20.3.7; version=20.3.7.1; version=20.3.7.2; version=20.3.8; version=20.3.813; version=20.3.814; version=20.4.1; version=20.4.1.0.01; version=20.4.1.0.02; version=20.4.1.0.1; version=20.4.1.1; version=20.4.1.1.5; version=20.4.1.2; version=20.4.2; version=20.4.2.0.1; version=20.4.2.0.2; version=20.4.2.0.4; version=20.4.2.1; version=20.4.2.1.1; version=20.4.2.2; version=20.4.2.2.1; version=20.4.2.2.2; version=20.4.2.2.3; version=20.4.2.2.4; version=20.5.0.1.1; version=20.5.1; version=20.5.1.0.1; version=20.5.1.0.2; version=20.5.1.1; version=20.5.1.2; version=20.6.0.18.3; version=20.6.0.18.4; version=20.6.1; version=20.6.1.0.1; version=20.6.1.1; version=20.6.1.2; version=20.6.2; version=20.6.2.0.4; version=20.6.2.1; version=20.6.2.2; version=20.6.2.2.2; version=20.6.2.2.3; version=20.6.2.2.4; version=20.6.2.2.7; version=20.6.3; version=20.7.1; version=20.7.1.0.2; version=20.7.1.1; version=20.7.1EFT2
Published CVSS scores
CVSS describes severity. EPSS estimates exploitation probability.
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Daily unique IPsNo honeypot observations are available for this CVE in the selected window.
Sep 9, 2026Sep 15, 2026
Latest reporting daySep 15, 2026
Latest daily unique IPsUnavailable
Prior 30-day averageUnavailable
SourceShadowserver honeypots (KEV)
Vectorlocal
Privilegesauthenticated
Known exploitationReported
Public exploitPublished
Weakness, pattern, technique
Public exploit references
- Orange CERT-CC vEdge confd privilege-escalation exploitfunctional · demonstrated
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Reported exploitation
- Cisco PSIRT attempted-exploitation observationreported exploitation
- CISA Known Exploited Vulnerabilities listingknown exploited catalog
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo