CVE-2025-20122: Cisco Catalyst SD-WAN Manager Escalation

CVE-2025-20122 Overview

CVE-2025-20122 is a privilege escalation vulnerability in the command-line interface (CLI) of Cisco Catalyst SD-WAN Manager, formerly known as Cisco SD-WAN vManage. The flaw allows an authenticated local attacker with read-only privileges to obtain root privileges on the underlying operating system. The vulnerability results from insufficient input validation in the CLI, which processes crafted requests without adequately restricting what a low-privileged user can invoke. Cisco published the advisory cisco-sa-sdwan-priviesc-WCk7bmmt covering the issue, which affects a broad range of Catalyst SD-WAN Manager releases from the 17.x branch through 20.15.1.

Critical Impact
A read-only account can escalate to root on the SD-WAN Manager, granting full control over the SD-WAN orchestration plane and every managed edge device.

Affected Products

Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) 17.2.x through 19.3.0
Cisco Catalyst SD-WAN Manager 20.1.x through 20.12.x
Cisco Catalyst SD-WAN Manager 20.13.1, 20.14.1, and 20.15.1

Discovery Timeline

2025-05-07 - CVE-2025-20122 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-20122

Vulnerability Analysis

Cisco Catalyst SD-WAN Manager is the centralized management and orchestration platform for Cisco's SD-WAN fabric. Administrators interact with it through both a web interface and a CLI. The CLI enforces a role-based command model in which read-only users are expected to be limited to non-destructive query commands. CVE-2025-20122 breaks that boundary. An authenticated attacker holding only read-only credentials can send a crafted CLI request that the platform processes with elevated privileges, resulting in code execution as root on the underlying operating system. Because SD-WAN Manager runs the control plane for all managed SD-WAN routers, root access to this host extends to policy tampering, credential theft, and lateral movement into the wider SD-WAN fabric. Cisco maps the weakness to [CWE-300], and the local attack vector means exploitation requires an existing account or shell session on the appliance.

Root Cause

The root cause is insufficient input validation in one or more CLI command handlers. The affected handlers do not correctly enforce the privilege boundary between read-only and privileged users, allowing crafted input to reach code paths that execute with root-equivalent authority.

Attack Vector

Exploitation requires local authenticated access with at least read-only privileges. The attacker connects to the SD-WAN Manager CLI over SSH or console access and submits a specifically crafted command. Successful exploitation yields a root shell on the underlying Linux operating system that hosts the SD-WAN Manager application.

// No public proof-of-concept is available for CVE-2025-20122.
// Refer to the Cisco Security Advisory cisco-sa-sdwan-priviesc-WCk7bmmt for
// authoritative technical details and fixed release information.

Detection Methods for CVE-2025-20122

Indicators of Compromise

Unexpected root-owned processes, cron entries, or SUID binaries appearing on an SD-WAN Manager host after CLI activity from a read-only account.
Audit log entries showing read-only users issuing atypical CLI commands or commands that historically require higher privilege levels.
New or modified accounts, SSH authorized keys, or configuration files on the SD-WAN Manager filesystem that do not correlate to change tickets.

Detection Strategies

Baseline CLI command usage per role and alert on read-only accounts executing commands outside their normal profile.
Correlate SSH session logs with process-execution telemetry on the SD-WAN Manager host to identify low-privilege sessions spawning root-owned processes.
Use configuration-drift monitoring on SD-WAN Manager to flag unauthorized changes to templates, policies, or device credentials that may follow a successful escalation.

Monitoring Recommendations

Forward SD-WAN Manager audit and system logs to a centralized SIEM and retain them long enough to support retrospective investigation.
Monitor authentication events for read-only accounts, particularly repeated logins from unusual source addresses or outside business hours.
Track Cisco PSIRT advisories and internal patch status for cisco-sa-sdwan-priviesc-WCk7bmmt to confirm remediation coverage.

How to Mitigate CVE-2025-20122

Immediate Actions Required

Upgrade Cisco Catalyst SD-WAN Manager to a fixed release as identified in the Cisco Security Advisory.
Inventory all read-only accounts on SD-WAN Manager and disable or rotate credentials for any that are unused or shared.
Restrict CLI access to a defined set of management jump hosts and enforce multi-factor authentication for administrative logins.

Patch Information

Cisco has released fixed software for CVE-2025-20122. Consult the advisory cisco-sa-sdwan-priviesc-WCk7bmmt for the exact fixed versions that correspond to each affected 17.x, 18.x, 19.x, and 20.x train, then plan upgrades based on your deployed release. There are no confirmed workarounds that fully address this vulnerability; upgrading is the recommended remediation.

Workarounds

Limit the number of users granted any level of CLI access, including read-only, until the appliance is patched.
Place SD-WAN Manager management interfaces behind a dedicated management network reachable only from hardened administrative hosts.
Increase logging verbosity for CLI sessions and require session recording for all interactive access to SD-WAN Manager.

bash

# Example: verify the running Catalyst SD-WAN Manager version before and after patching
vmanage# show system status | include Version

# Example: list configured users and roles to identify read-only accounts that need review
vmanage# show running-config system aaa user