A remote authenticated attacker with read‑only API credentials can upload a malicious file to Cisco Catalyst SD‑WAN Manager. The API improperly handles file names, allowing the attacker to overwrite any file on the local file system. By replacing critical files the attacker can gain vmanage user privileges and compromise system integrity. The flaw is classified as CWE‑648: Unrestricted Write to Arbitrary File.

Affected products include Cisco Catalyst SD‑WAN Manager, notably version 20.12.6 and potentially earlier releases as indicated by the CPE strings. The vulnerability exists in the API layer that processes file uploads.

The CVSS v3.1 base score is 5.4, indicating moderate impact, while the EPSS score is below 1%, suggesting a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires remote access to the API with valid, albeit read‑only, credentials, so the attack vector is remote authenticated with limited initial privileges. If successful, the attacker can overwrite arbitrary files and elevate privileges, representing a significant security concern.