A vulnerability in Cisco Catalyst SD‑WAN Manager allows an authenticated, local attacker with low privileges to gain root privileges on the underlying operating system. The flaw is caused by an insufficient authentication mechanism in the REST API that can be bypassed through crafted requests. The resulting escalation can compromise the entire device, allowing full control over network functions and configuration. The weakness is classified as CWE‑648.

The affected product is Cisco Catalyst SD‑WAN Manager, including version 20.12.6 and earlier releases. The CPE entries confirm that the vulnerability applies to the SD‑WAN Manager product line. Users of newer, patched releases should verify that they are not affected.

The CVSS base score of 8.8 signals a high severity, while the EPSS score of less than 1 % indicates a very low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalogue. The likely attack vector is a local network connection where the attacker has authenticated with a non‑privileged account; the REST API endpoint can then be exploited to elevate privileges to root. If exploited, the attacker can modify, disable, or disrupt all SD‑WAN services, leading to loss of confidentiality, integrity, and availability of the network.