{"uuid": "a45fd930-b216-419e-973d-301dd45e7d74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20127", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/networking/cisco_sdwan_auth_bypass.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"sfewer-r7\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an authentication bypass vulnerability (CVE-2026-20127)\\n          in the Cisco Catalyst SD-WAN Controller (vSmart). The vdaemon DTLS control-plane\\n          service fails to properly validate the verify_status byte in CHALLENGE_ACK_ACK\\n          (msg_type=10) messages. The vbond_proc_challenge_ack_ack() handler reads an\\n          attacker-controlled verify_status byte from the message body and, if non-zero,\\n          sets the peer's authenticated flag to 1. Furthermore, the authentication gate in\\n          vbond_proc_msg() exempts msg_type=10 from authentication checks, allowing an\\n          unauthenticated peer to send this message.\\n\\n          An attacker can connect via DTLS 1.2 using a self-signed certificate (the server\\n          performs no certificate validation at the handshake stage), skip the CHALLENGE_ACK\\n          step, and send a forged CHALLENGE_ACK_ACK with verify_status=1 to become a trusted\\n          peer without any legitimate credentials.\\n\\n          This module leverages the auth bypass to inject an SSH public key into the\\n          vmanage-admin authorized_keys file via a VMANAGE_TO_PEER message, providing\\n          persistent SSH access to the controller.\", \"disclosure_date\": \"2026-02-25\", \"fullname\": \"auxiliary/admin/networking/cisco_sdwan_auth_bypass\", \"is_install_path\": true, \"mod_time\": \"2026-06-30 14:15:16 +0000\", \"name\": \"Cisco Catalyst SD-WAN Controller Authentication Bypass\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/admin/networking/cisco_sdwan_auth_bypass.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"admin/networking/cisco_sdwan_auth_bypass\", \"references\": [\"CVE-2026-20127\", \"URL-https://github.com/sfewer-r7/CVE-2026-20127\", \"URL-https://attackerkb.com/topics/bP3FMvHe7z/cve-2026-20127/rapid7-analysis\", \"URL-https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk\", \"URL-https://blog.talosintelligence.com/uat-8616-sd-wan/\"], \"rport\": 12346, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:46:53.419815Z"}