CVE-2025-20122

07.05.2025, 18:15

A vulnerability in the CLI of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, local attacker to gain privileges of the root user on the underlying operating system.

This vulnerability is due to insufficient input validation. An authenticated attacker with read-only privileges on the SD-WAN Manager system could exploit this vulnerability by sending a crafted request to the CLI of the SD-WAN Manager. A successful exploit could allow the attacker to gain root privileges on the underlying operating system.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	7.8 HIGH	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cisco	CNA	7.8 HIGH	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA-ADP	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 4%

Vendor	Product	Version
cisco	catalyst_sd-wan_manager	17.2.4
cisco	catalyst_sd-wan_manager	17.2.5
cisco	catalyst_sd-wan_manager	17.2.6
cisco	catalyst_sd-wan_manager	17.2.7
cisco	catalyst_sd-wan_manager	17.2.8
cisco	catalyst_sd-wan_manager	17.2.9
cisco	catalyst_sd-wan_manager	17.2.10
cisco	catalyst_sd-wan_manager	18.2.0
cisco	catalyst_sd-wan_manager	18.3.0
cisco	catalyst_sd-wan_manager	18.3.1
cisco	catalyst_sd-wan_manager	18.3.1.1
cisco	catalyst_sd-wan_manager	18.3.3
cisco	catalyst_sd-wan_manager	18.3.3.1
cisco	catalyst_sd-wan_manager	18.3.4
cisco	catalyst_sd-wan_manager	18.3.5
cisco	catalyst_sd-wan_manager	18.3.6
cisco	catalyst_sd-wan_manager	18.3.6.1
cisco	catalyst_sd-wan_manager	18.3.7
cisco	catalyst_sd-wan_manager	18.3.8
cisco	catalyst_sd-wan_manager	18.4.0
cisco	catalyst_sd-wan_manager	18.4.0.1
cisco	catalyst_sd-wan_manager	18.4.1
cisco	catalyst_sd-wan_manager	18.4.3
cisco	catalyst_sd-wan_manager	18.4.4
cisco	catalyst_sd-wan_manager	18.4.5
cisco	catalyst_sd-wan_manager	18.4.6
cisco	catalyst_sd-wan_manager	18.4.302
cisco	catalyst_sd-wan_manager	18.4.303
cisco	catalyst_sd-wan_manager	18.4.501_es:_es
cisco	catalyst_sd-wan_manager	19.0.0
cisco	catalyst_sd-wan_manager	19.0.1a:a
cisco	catalyst_sd-wan_manager	19.1.0
cisco	catalyst_sd-wan_manager	19.2.0
cisco	catalyst_sd-wan_manager	19.2.1
cisco	catalyst_sd-wan_manager	19.2.2
cisco	catalyst_sd-wan_manager	19.2.3
cisco	catalyst_sd-wan_manager	19.2.4
cisco	catalyst_sd-wan_manager	19.2.4.0.1
cisco	catalyst_sd-wan_manager	19.2.4.0.8
cisco	catalyst_sd-wan_manager	19.2.4.0.9
cisco	catalyst_sd-wan_manager	19.2.31
cisco	catalyst_sd-wan_manager	19.2.32
cisco	catalyst_sd-wan_manager	19.2.097
cisco	catalyst_sd-wan_manager	19.2.098
cisco	catalyst_sd-wan_manager	19.2.099
cisco	catalyst_sd-wan_manager	19.2.929
cisco	catalyst_sd-wan_manager	19.3.0
cisco	catalyst_sd-wan_manager	20.1.1
cisco	catalyst_sd-wan_manager	20.1.1.1
cisco	catalyst_sd-wan_manager	20.1.2
cisco	catalyst_sd-wan_manager	20.1.2_937:_937
cisco	catalyst_sd-wan_manager	20.1.3
cisco	catalyst_sd-wan_manager	20.1.3.1
cisco	catalyst_sd-wan_manager	20.1.12
cisco	catalyst_sd-wan_manager	20.3.1
cisco	catalyst_sd-wan_manager	20.3.2
cisco	catalyst_sd-wan_manager	20.3.2.0.5
cisco	catalyst_sd-wan_manager	20.3.2.0.6
cisco	catalyst_sd-wan_manager	20.3.2.1
cisco	catalyst_sd-wan_manager	20.3.2.1_927:_927
cisco	catalyst_sd-wan_manager	20.3.2.1_930:_930
cisco	catalyst_sd-wan_manager	20.3.2_925:_925
cisco	catalyst_sd-wan_manager	20.3.2_928:_928
cisco	catalyst_sd-wan_manager	20.3.2_929:_929
cisco	catalyst_sd-wan_manager	20.3.2_937:_937
cisco	catalyst_sd-wan_manager	20.3.3
cisco	catalyst_sd-wan_manager	20.3.3.0.2
cisco	catalyst_sd-wan_manager	20.3.3.0.4
cisco	catalyst_sd-wan_manager	20.3.3.0.8
cisco	catalyst_sd-wan_manager	20.3.3.0.14
cisco	catalyst_sd-wan_manager	20.3.3.0.16
cisco	catalyst_sd-wan_manager	20.3.3.0.17
cisco	catalyst_sd-wan_manager	20.3.3.0.18
cisco	catalyst_sd-wan_manager	20.3.3.1
cisco	catalyst_sd-wan_manager	20.3.3.1.1
cisco	catalyst_sd-wan_manager	20.3.3.1.2
cisco	catalyst_sd-wan_manager	20.3.3.1.5
cisco	catalyst_sd-wan_manager	20.3.3.1.7
cisco	catalyst_sd-wan_manager	20.3.3.1.10
cisco	catalyst_sd-wan_manager	20.3.3.2
cisco	catalyst_sd-wan_manager	20.3.4
cisco	catalyst_sd-wan_manager	20.3.4.0.1
cisco	catalyst_sd-wan_manager	20.3.4.0.5
cisco	catalyst_sd-wan_manager	20.3.4.0.6
cisco	catalyst_sd-wan_manager	20.3.4.0.9
cisco	catalyst_sd-wan_manager	20.3.4.0.11
cisco	catalyst_sd-wan_manager	20.3.4.0.19
cisco	catalyst_sd-wan_manager	20.3.4.0.20
cisco	catalyst_sd-wan_manager	20.3.4.0.24
cisco	catalyst_sd-wan_manager	20.3.4.0.25
cisco	catalyst_sd-wan_manager	20.3.4.0.26
cisco	catalyst_sd-wan_manager	20.3.4.1
cisco	catalyst_sd-wan_manager	20.3.4.1.1
cisco	catalyst_sd-wan_manager	20.3.4.1.2
cisco	catalyst_sd-wan_manager	20.3.4.2
cisco	catalyst_sd-wan_manager	20.3.4.2.1
cisco	catalyst_sd-wan_manager	20.3.4.2.2
cisco	catalyst_sd-wan_manager	20.3.4.3
cisco	catalyst_sd-wan_manager	20.3.5
cisco	catalyst_sd-wan_manager	20.3.5.0.7
cisco	catalyst_sd-wan_manager	20.3.5.0.8
cisco	catalyst_sd-wan_manager	20.3.5.0.9
cisco	catalyst_sd-wan_manager	20.3.5.1
cisco	catalyst_sd-wan_manager	20.3.6
cisco	catalyst_sd-wan_manager	20.3.7
cisco	catalyst_sd-wan_manager	20.3.7.1
cisco	catalyst_sd-wan_manager	20.3.7.2
cisco	catalyst_sd-wan_manager	20.3.8
cisco	catalyst_sd-wan_manager	20.3.813
cisco	catalyst_sd-wan_manager	20.3.814
cisco	catalyst_sd-wan_manager	20.4.1
cisco	catalyst_sd-wan_manager	20.4.1.0.01
cisco	catalyst_sd-wan_manager	20.4.1.0.1
cisco	catalyst_sd-wan_manager	20.4.1.0.02
cisco	catalyst_sd-wan_manager	20.4.1.1
cisco	catalyst_sd-wan_manager	20.4.1.1.5
cisco	catalyst_sd-wan_manager	20.4.1.2
cisco	catalyst_sd-wan_manager	20.4.2
cisco	catalyst_sd-wan_manager	20.4.2.0.1
cisco	catalyst_sd-wan_manager	20.4.2.0.2
cisco	catalyst_sd-wan_manager	20.4.2.0.4
cisco	catalyst_sd-wan_manager	20.4.2.1
cisco	catalyst_sd-wan_manager	20.4.2.1.1
cisco	catalyst_sd-wan_manager	20.4.2.2
cisco	catalyst_sd-wan_manager	20.4.2.2.1
cisco	catalyst_sd-wan_manager	20.4.2.2.2
cisco	catalyst_sd-wan_manager	20.4.2.2.3
cisco	catalyst_sd-wan_manager	20.4.2.2.4
cisco	catalyst_sd-wan_manager	20.4.2.2.8
cisco	catalyst_sd-wan_manager	20.4.2.3
cisco	catalyst_sd-wan_manager	20.5.0.1.1
cisco	catalyst_sd-wan_manager	20.5.1
cisco	catalyst_sd-wan_manager	20.5.1.0.1
cisco	catalyst_sd-wan_manager	20.5.1.0.2
cisco	catalyst_sd-wan_manager	20.5.1.1
cisco	catalyst_sd-wan_manager	20.5.1.2
cisco	catalyst_sd-wan_manager	20.6.0.18.3
cisco	catalyst_sd-wan_manager	20.6.0.18.4
cisco	catalyst_sd-wan_manager	20.6.1
cisco	catalyst_sd-wan_manager	20.6.1.0.1
cisco	catalyst_sd-wan_manager	20.6.1.1
cisco	catalyst_sd-wan_manager	20.6.1.2
cisco	catalyst_sd-wan_manager	20.6.2
cisco	catalyst_sd-wan_manager	20.6.2.0.4
cisco	catalyst_sd-wan_manager	20.6.2.1
cisco	catalyst_sd-wan_manager	20.6.2.2
cisco	catalyst_sd-wan_manager	20.6.2.2.2
cisco	catalyst_sd-wan_manager	20.6.2.2.3
cisco	catalyst_sd-wan_manager	20.6.2.2.4
cisco	catalyst_sd-wan_manager	20.6.2.2.7
cisco	catalyst_sd-wan_manager	20.6.3
cisco	catalyst_sd-wan_manager	20.6.3.0.2
cisco	catalyst_sd-wan_manager	20.6.3.0.5
cisco	catalyst_sd-wan_manager	20.6.3.0.7
cisco	catalyst_sd-wan_manager	20.6.3.0.10
cisco	catalyst_sd-wan_manager	20.6.3.0.11
cisco	catalyst_sd-wan_manager	20.6.3.0.14
cisco	catalyst_sd-wan_manager	20.6.3.0.18
cisco	catalyst_sd-wan_manager	20.6.3.0.19
cisco	catalyst_sd-wan_manager	20.6.3.0.23
cisco	catalyst_sd-wan_manager	20.6.3.0.25
cisco	catalyst_sd-wan_manager	20.6.3.0.27
cisco	catalyst_sd-wan_manager	20.6.3.0.29
cisco	catalyst_sd-wan_manager	20.6.3.0.31
cisco	catalyst_sd-wan_manager	20.6.3.0.32
cisco	catalyst_sd-wan_manager	20.6.3.0.33
cisco	catalyst_sd-wan_manager	20.6.3.0.38
cisco	catalyst_sd-wan_manager	20.6.3.0.39
cisco	catalyst_sd-wan_manager	20.6.3.0.40
cisco	catalyst_sd-wan_manager	20.6.3.0.41
cisco	catalyst_sd-wan_manager	20.6.3.0.45
cisco	catalyst_sd-wan_manager	20.6.3.0.46
cisco	catalyst_sd-wan_manager	20.6.3.0.47
cisco	catalyst_sd-wan_manager	20.6.3.0.51
cisco	catalyst_sd-wan_manager	20.6.3.1
cisco	catalyst_sd-wan_manager	20.6.3.1.1
cisco	catalyst_sd-wan_manager	20.6.3.2
cisco	catalyst_sd-wan_manager	20.6.3.3
cisco	catalyst_sd-wan_manager	20.6.3.4
cisco	catalyst_sd-wan_manager	20.6.4
cisco	catalyst_sd-wan_manager	20.6.4.0.4
cisco	catalyst_sd-wan_manager	20.6.4.0.19
cisco	catalyst_sd-wan_manager	20.6.4.0.21
cisco	catalyst_sd-wan_manager	20.6.4.1
cisco	catalyst_sd-wan_manager	20.6.4.2
cisco	catalyst_sd-wan_manager	20.6.5
cisco	catalyst_sd-wan_manager	20.6.5.1
cisco	catalyst_sd-wan_manager	20.6.5.1.2
cisco	catalyst_sd-wan_manager	20.6.5.1.3
cisco	catalyst_sd-wan_manager	20.6.5.1.4
cisco	catalyst_sd-wan_manager	20.6.5.1.5
cisco	catalyst_sd-wan_manager	20.6.5.1.6
cisco	catalyst_sd-wan_manager	20.6.5.1.7
cisco	catalyst_sd-wan_manager	20.6.5.1.9
cisco	catalyst_sd-wan_manager	20.6.5.1.10
cisco	catalyst_sd-wan_manager	20.6.5.1.11
cisco	catalyst_sd-wan_manager	20.6.5.1.13
cisco	catalyst_sd-wan_manager	20.6.5.1.14
cisco	catalyst_sd-wan_manager	20.6.5.2
cisco	catalyst_sd-wan_manager	20.6.5.2.1
cisco	catalyst_sd-wan_manager	20.6.5.2.3
cisco	catalyst_sd-wan_manager	20.6.5.2.4
cisco	catalyst_sd-wan_manager	20.6.5.2.8
cisco	catalyst_sd-wan_manager	20.6.5.3
cisco	catalyst_sd-wan_manager	20.6.5.4
cisco	catalyst_sd-wan_manager	20.6.5.5
cisco	catalyst_sd-wan_manager	20.6.6
cisco	catalyst_sd-wan_manager	20.6.6.0.1
cisco	catalyst_sd-wan_manager	20.6.7
cisco	catalyst_sd-wan_manager	20.6.8
cisco	catalyst_sd-wan_manager	20.7.1
cisco	catalyst_sd-wan_manager	20.7.1.0.2
cisco	catalyst_sd-wan_manager	20.7.1.1
cisco	catalyst_sd-wan_manager	20.7.1eft2:eft2
cisco	catalyst_sd-wan_manager	20.7.2
cisco	catalyst_sd-wan_manager	20.8.1
cisco	catalyst_sd-wan_manager	20.9.1
cisco	catalyst_sd-wan_manager	20.9.1.1
cisco	catalyst_sd-wan_manager	20.9.1eft2:eft2
cisco	catalyst_sd-wan_manager	20.9.2
cisco	catalyst_sd-wan_manager	20.9.2.0.01
cisco	catalyst_sd-wan_manager	20.9.2.1
cisco	catalyst_sd-wan_manager	20.9.2.2
cisco	catalyst_sd-wan_manager	20.9.2.3
cisco	catalyst_sd-wan_manager	20.9.3
cisco	catalyst_sd-wan_manager	20.9.3.0.2
cisco	catalyst_sd-wan_manager	20.9.3.0.3
cisco	catalyst_sd-wan_manager	20.9.3.0.4
cisco	catalyst_sd-wan_manager	20.9.3.0.5
cisco	catalyst_sd-wan_manager	20.9.3.0.7
cisco	catalyst_sd-wan_manager	20.9.3.0.8
cisco	catalyst_sd-wan_manager	20.9.3.0.12
cisco	catalyst_sd-wan_manager	20.9.3.0.16
cisco	catalyst_sd-wan_manager	20.9.3.0.17
cisco	catalyst_sd-wan_manager	20.9.3.0.18
cisco	catalyst_sd-wan_manager	20.9.3.0.20
cisco	catalyst_sd-wan_manager	20.9.3.0.21
cisco	catalyst_sd-wan_manager	20.9.3.0.23
cisco	catalyst_sd-wan_manager	20.9.3.0.24
cisco	catalyst_sd-wan_manager	20.9.3.0.25
cisco	catalyst_sd-wan_manager	20.9.3.0.26
cisco	catalyst_sd-wan_manager	20.9.3.0.29
cisco	catalyst_sd-wan_manager	20.9.3.1
cisco	catalyst_sd-wan_manager	20.9.3.2
cisco	catalyst_sd-wan_manager	20.9.4
cisco	catalyst_sd-wan_manager	20.9.4.0.4
cisco	catalyst_sd-wan_manager	20.9.4.1
cisco	catalyst_sd-wan_manager	20.9.4.1.1
cisco	catalyst_sd-wan_manager	20.9.4.1.3
cisco	catalyst_sd-wan_manager	20.9.4.1.6
cisco	catalyst_sd-wan_manager	20.9.5
cisco	catalyst_sd-wan_manager	20.9.5.1
cisco	catalyst_sd-wan_manager	20.9.5.1.4
cisco	catalyst_sd-wan_manager	20.9.5.2
cisco	catalyst_sd-wan_manager	20.9.5.2.1
cisco	catalyst_sd-wan_manager	20.9.5.2.7
cisco	catalyst_sd-wan_manager	20.9.5.2.13
cisco	catalyst_sd-wan_manager	20.9.5.2.14
cisco	catalyst_sd-wan_manager	20.9.5.2.16
cisco	catalyst_sd-wan_manager	20.9.5.2.21
cisco	catalyst_sd-wan_manager	20.9.5.3
cisco	catalyst_sd-wan_manager	20.9.6
cisco	catalyst_sd-wan_manager	20.9.6.0.3
cisco	catalyst_sd-wan_manager	20.10.1
cisco	catalyst_sd-wan_manager	20.10.1.1
cisco	catalyst_sd-wan_manager	20.10.1.2
cisco	catalyst_sd-wan_manager	20.11.1
cisco	catalyst_sd-wan_manager	20.11.1.1
cisco	catalyst_sd-wan_manager	20.11.1.2
cisco	catalyst_sd-wan_manager	20.12.1
cisco	catalyst_sd-wan_manager	20.12.2
cisco	catalyst_sd-wan_manager	20.12.3
cisco	catalyst_sd-wan_manager	20.12.3.1
cisco	catalyst_sd-wan_manager	20.12.4
cisco	catalyst_sd-wan_manager	20.12.4.0.03
cisco	catalyst_sd-wan_manager	20.12.4.0.4
cisco	catalyst_sd-wan_manager	20.12.4.0.6
cisco	catalyst_sd-wan_manager	20.12.4.1
cisco	catalyst_sd-wan_manager	20.12.401
cisco	catalyst_sd-wan_manager	20.13.1
cisco	catalyst_sd-wan_manager	20.14.1
cisco	catalyst_sd-wan_manager	20.15.1

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-300 - Channel Accessible by Non-Endpoint
The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-priviesc-WCk7bmmt