A vulnerability in the CLI of Cisco Catalyst SD-WAN Manager

Based on the supplied intel, CVE-2026-20245 is a Cisco Catalyst SD-WAN Manager CLI privilege-escalation issue: a low-privilege user with local CLI access can abuse flawed input handling and end up executing with root privileges on the manager appliance. That matters because SD-WAN Manager is a control-plane system with access to configs, credentials, certificates, and downstream device orchestration. I could not confirm a public Cisco advisory or CVE record for this exact ID in current public lookups, so affected version ranges and fixed releases remain unconfirmed from public sources.

Cisco's HIGH 7.8 score is technically consistent with the CVSS vector, but it overstates operational urgency for most enterprises. AV:L/PR:L on a management appliance means the attacker already has a foothold, valid credentials, and CLI reachability to one of the most restricted systems in the estate; that's classic post-initial-access territory. The blast radius is real if exploited, but the reachable population is narrow enough that this lands as MEDIUM for patch-priority purposes.

Why this verdict

• Requires prior compromise: AV:L/PR:L on SD-WAN Manager means the attacker already has a foothold plus valid credentials on one of your most restricted systems. That is two stages past initial access, so I subtract meaningfully from Cisco's 7.8 baseline.
• Reachable population is narrow: real enterprises do not expose Manager CLI to everyone; access is usually through bastions, PAM, or a small network-ops group. Each one of those controls compounds friction and cuts the practical attack pool.
• Impact is still real: if exploited, root on SD-WAN Manager is not a toy outcome. The manager sits near configs, certificates, and downstream orchestration, so I am not pushing this into LOW.

Why not higher?

There is no evidence here of unauthenticated remote reachability, no public exploitation evidence for this exact CVE, and no KEV listing. A bug that starts with local authenticated CLI access on a management appliance is fundamentally different from the SD-WAN flaws that gave attackers first entry from the network.

Why not lower?

Root on the SD-WAN Manager can translate into policy tampering, secret theft, and broad downstream operational impact. Even though the exploit is post-compromise, the asset value and potential blast radius are too high to dismiss as backlog-only hygiene.

1. Clamp CLI access to bastions only — Force all SD-WAN Manager CLI access through approved jump hosts, deny direct admin-subnet sprawl, and narrow the allowed source IPs and user groups. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but this control is worth doing immediately because it directly attacks the main prerequisite.
2. Shrink low-priv CLI entitlements — Remove read-only CLI access from users who only need the web UI or API, and review break-glass and shared operations accounts. Again, there is no mitigation SLA for MEDIUM; treat this as durable hardening while completing patching within the remediation window.
3. Turn on session accountability — Enable AAA accounting, session recording where available, and external log retention for SSH/CLI activity to the manager. This will not prevent exploitation, but it raises the cost of insider misuse and gives you something to investigate if a low-priv account suddenly behaves like root.

Run this on each Cisco Catalyst SD-WAN Manager appliance from a shell account that can read local release files; sudo is recommended. Save as check_vmanage_cve_2026_20245.sh and run sudo bash check_vmanage_cve_2026_20245.sh 20.12.5.4 where the argument is the vendor-confirmed fixed version for your branch; because the public fixed release for this CVE was not verifiable, the script compares the local version to the version you supply.

#!/usr/bin/env bash
# check_vmanage_cve_2026_20245.sh
# Purpose: Best-effort local version check for Cisco Catalyst SD-WAN Manager
# Usage: sudo bash check_vmanage_cve_2026_20245.sh <fixed-version>
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

FIXED_VERSION="${1:-}"
if [ -z "$FIXED_VERSION" ]; then
  echo "UNKNOWN - usage: $0 <fixed-version>"
  exit 2
fi

trim() {
  sed 's/^[[:space:]]*//;s/[[:space:]]*$//'
}

extract_version() {
  grep -Eo '[0-9]+(\.[0-9]+){1,3}' | head -n1
}

get_current_version() {
  local v=""

  # Common local files first
  for f in /etc/cisco-release /etc/viptela-release /opt/viptela/etc/version /etc/issue; do
    if [ -r "$f" ]; then
      v=$(cat "$f" 2>/dev/null | extract_version)
      if [ -n "$v" ]; then
        echo "$v"
        return 0
      fi
    fi
  done

  # Try CLI commands if present
  if command -v show >/dev/null 2>&1; then
    v=$(show version 2>/dev/null | extract_version)
    if [ -n "$v" ]; then
      echo "$v"
      return 0
    fi
  fi

  if command -v vmanage >/dev/null 2>&1; then
    v=$(vmanage version 2>/dev/null | extract_version)
    if [ -n "$v" ]; then
      echo "$v"
      return 0
    fi
  fi

  return 1
}

version_ge() {
  # returns 0 if $1 >= $2
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | tail -n1)" = "$1" ]
}

CURRENT_VERSION=$(get_current_version | trim)

if [ -z "$CURRENT_VERSION" ]; then
  echo "UNKNOWN - could not determine installed Cisco Catalyst SD-WAN Manager version"
  exit 2
fi

if version_ge "$CURRENT_VERSION" "$FIXED_VERSION"; then
  echo "PATCHED - current version $CURRENT_VERSION is >= supplied fixed version $FIXED_VERSION"
  exit 0
else
  echo "VULNERABLE - current version $CURRENT_VERSION is < supplied fixed version $FIXED_VERSION"
  exit 1
fi

Sources

1. Cisco advisory: CVE-2025-20122 comparable SD-WAN Manager CLI privilege escalation
2. Cisco support page: CVE-2025-20122 advisory landing page
3. NVD: CVE-2025-20122
4. Cisco advisory: Catalyst SD-WAN Manager arbitrary file overwrite vulnerability
5. Cisco advisory: SD-WAN software privilege escalation vulnerabilities
6. Cisco security advisories list for SD-WAN products
7. CISA Known Exploited Vulnerabilities Catalog
8. VulnCheck analysis of Cisco SD-WAN Manager exposure