Cisco Catalyst SD-WAN Controller vHub Authentication Bypass

MetasploitMetasploit auxiliary PoCExploitRubyauxiliary_admin/networking/cisco_sdwan_vhub_auth_bypass

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

This Metasploit auxiliary module exploits CVE-2026-20182, an authentication bypass in Cisco Catalyst SD-WAN Controller. It performs a DTLS handshake with a self-signed certificate, sends a CHALLENGE_ACK claiming to be a vHub (device type 2) to bypass authentication, and then injects an attacker-controlled SSH public key into the vmanage-admin user's authorized_keys file via a VMANAGE_TO_PEER message, providing persistent SSH access.

Backdoor review

No backdoor observed in reviewed code

The reviewed Metasploit module source code implements a documented authentication bypass exploit (CVE-2026-20182) against Cisco Catalyst SD-WAN Controller. It performs a DTLS handshake with a self-signed certificate, sends a crafted CHALLENGE_ACK claiming to be a vHub device to bypass authentication, and optionally injects an SSH public key into the vmanage-admin user's authorized_keys file for persistent NETCONF access. All behavior is consistent with the stated exploit purpose; no concealed backdoor, unrelated payload, or operator-directed harm was observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagesruby
Target softwareCisco Catalyst SD-WAN Controller
Attack typesauthentication_bypassssh_key_injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module actively exploits the vulnerability by performing the authentication bypass and then injecting an SSH key to gain persistent access, which goes beyond mere detection or scanning.

modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:86-101modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:105-134

Requirements

  • Network access to the target's UDP port 12346 (vdaemon DTLS control-plane service).modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:64
  • OpenSSL libraries available on the attacker's system for DTLS handshake via FFI.modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:538-574

Observed behavior

  • Performs a DTLS handshake using a self-signed certificate without verifying the server's certificate.modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:136-195
  • Sends a CHALLENGE_ACK message with device type set to vHub (2) to trigger the authentication bypass.modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:215-222
  • Injects an SSH public key into the vmanage-admin user's authorized_keys file via a VMANAGE_TO_PEER message.modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:266-311
  • Provides instructions to connect to the NETCONF service (TCP port 830) using the injected SSH key.modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:278-296
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Authentication bypass via vHub device type in CHALLENGE_ACKThe module sends a CHALLENGE_ACK message with device type 2 (vHub) to bypass authentication, as described in the module metadata and CVE context.modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:215-222
Exploit Behavior
SSH public key injection into vmanage-admin authorized_keysThe module builds and sends a VMANAGE_TO_PEER message containing an attacker-controlled SSH public key, providing persistent access to the target's NETCONF service.modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:266-311
Exploit Behavior
DTLS handshake with self-signed certificateThe module generates an in-memory self-signed certificate and performs a DTLS handshake without verifying the server's certificate, as required for the exploit.modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:136-195
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the provided module source code and metadata; the code was not executed, and its effectiveness or safety is not verified.
  • The evidence does not include the framework mixins, libraries, or external payloads referenced by the module, so the full runtime behavior cannot be assessed.
  • Only the module source code and metadata were reviewed; Metasploit framework mixins, libraries, and external payloads were not expanded or analyzed.
  • Binary files were not inspected (none present in evidence).
  • The review does not assess the safety or reliability of the exploit against production systems.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1