Cisco Catalyst SD-WAN Manager Arbitrary File Creation Vulnerability

🚨SEVERITY: MEDIUM — CVSS 6.5Security Advisory

TL;DR 📌

  • A vulnerability in the application data endpoints of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote attacker to write arbitrary files to an affected system. This vulnerability is due to improper validation of requests to APIs. An attacker could exploit this vulnerability by sending malicious requests to an API within…
  • Highest CVSS: 6.5 (Medium).
  • Fix available — see the first fixed release below.
  • CVEs: CVE-2025-20187.

What it is

CVE-2025-20187 is an arbitrary file creation vulnerability in Cisco Catalyst SD-WAN Manager (formerly Cisco SD-WAN vManage), specifically in the application data endpoints of its API.

The flaw is caused by improper validation of API requests. An authenticated, remote attacker with low privileges can send crafted requests to an affected API and carry out directory traversal, allowing them to write files to arbitrary locations on the underlying system. The attack surface is the management-plane API rather than the data plane, and no user interaction is required (AC:L, PR:L, UI:N, AV:N per the CVSS vector).

The impact is limited to integrity: the vector shows C:N/I:H/A:N, meaning the attacker can write/modify files but the advisory does not indicate this leads to confidentiality loss or denial of service on its own. Cisco’s PSIRT states it is not aware of any public announcements or malicious use of this vulnerability.

What to do

  • Upgrade Cisco Catalyst SD-WAN Manager. Cisco has published fixed releases:
    • 20.9 train: upgrade to 20.9.7
    • 20.15 train: upgrade to 20.15.2
  • There are no workarounds — mitigation requires the software update.
  • If you’re running an older or end-of-life train not listed above (e.g. releases marked “Not vulnerable” but past End of Software Maintenance), consult the advisory’s fixed-release table for your specific version and migrate to a supported, fixed release rather than relying on EoL builds.
  • Since exploitation requires authentication, review who holds low-privilege accounts on SD-WAN Manager and tighten access to the management API where possible while patching is scheduled.
  • This advisory is one of a related set covering separate Catalyst SD-WAN Manager vulnerabilities (privilege escalation, certificate validation, arbitrary file overwrite, stored XSS) — check whether those apply to your deployment as well, since they are patched independently.

Fixed releases

Affected release First fixed release
20.92 20.9.7
20.15 20.15.2

For leadership 🧭

Executive summary. A logged-in but low-privilege user on SD-WAN Manager can exploit a flawed API to plant files outside their intended location on the underlying server, undermining system integrity. There is no workaround, so the fix needs to go into the next available change window rather than being deferred indefinitely.

Why it matters:

  • The vulnerable API sits on the SD-WAN Manager management plane, meaning anyone with low-privilege authenticated access can reach it without needing admin rights or user interaction
  • Directory traversal in the application data endpoints lets an attacker write files to arbitrary locations on the underlying system, which could be used to plant or tamper with files outside normal application boundaries
  • There are no workarounds published for this issue, so mitigation depends entirely on upgrading to a fixed release (20.9.7 or 20.15.2 depending on train)
  • This is one of several separately patched Catalyst SD-WAN Manager vulnerabilities disclosed together, so a single upgrade pass should be checked against the full set rather than just this CVE

Now / Next / Later:

  • Now: Identify which Cisco Catalyst SD-WAN Manager version and train (20.9.x or 20.15.x) you are running and check it against the fixed-release table, and review who currently holds low-privilege accounts with API access.
  • Next: Upgrade SD-WAN Manager to the fixed release for your train — 20.9.7 for the 20.9 line or 20.15.2 for the 20.15 line — during your next change window, since no workaround exists.
  • Later: When planning this upgrade, review the other related Catalyst SD-WAN Manager advisories (privilege escalation, certificate validation, file overwrite, stored XSS) covering the same product and confirm each is separately remediated in your environment.

Source