CVE-2025-20213: Cisco Catalyst SDWAN Manager Arbitrary File Overwrite Vulnerability
Description
A vulnerability in the CLI of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, local attacker to overwrite arbitrary files on the local file system of an affected device. To exploit this vulnerability, the attacker must have valid read-only credentials with CLI access on the affected system.
This vulnerability is due to improper access controls on files that are on the local file system. An attacker could exploit this vulnerability by running a series of crafted commands on the local file system of an affected device. A successful exploit could allow the attacker to overwrite arbitrary files on the affected device and gain privileges of the root user. To exploit this vulnerability, an attacker would need to have CLI access as a low-privilege user.
Classification
CVE ID: CVE-2025-20213
CVSS Base Severity: MEDIUM
CVSS Base Score: 5.5
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Problem Types
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Affected Products
Vendor: Cisco
Product: Cisco Catalyst SD-WAN Manager
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.03% (probability of being exploited)
EPSS Percentile: 5.22% (scored less or equal to compared to others)
EPSS Date: 2025-05-13 (when was this score calculated)
References
https://nvd.nist.gov/vuln/detail/CVE-2025-20213https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-fileoverwrite-Uc9tXWH