CVE-2026-20182

GitHubCurated repository PoCExploitC++SecureWithUmer/CVE-2026-PoCs

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python exploit for CVE-2026-20182 that bypasses authentication on Cisco Catalyst SD-WAN Controller/Manager by sending crafted DTLS messages claiming to be a vHub (device_type=2), then injects an SSH public key for persistent NETCONF/SSH access.

Backdoor review

No backdoor observed in reviewed code

The PoC consists of a README and a Python script that implement the documented CVE-2026-20182 authentication bypass. The script performs a DTLS handshake, sends crafted messages to bypass authentication, and injects an SSH public key for NETCONF/SSH access. All behavior aligns with the stated exploit purpose; no concealed backdoor, unrelated payload, or operator-directed harm is present.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareCisco Catalyst SD-WAN ControllerCisco Catalyst SD-WAN Manager
Attack typesauthentication_bypassssh_key_injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a complete Python script (cve-2026-20182.py) that actively exploits CVE-2026-20182 by sending crafted DTLS messages to bypass authentication and inject an SSH key for remote access. The README explicitly describes it as a 'proof-of-concept exploit' and details the exploitation steps. The code performs the attack, not just detection or scanning.

portbuster1337-CVE-2026-20182-a75f627/README.md:3portbuster1337-CVE-2026-20182-a75f627/README.md:15-22portbuster1337-CVE-2026-20182-a75f627/cve-2026-20182.py:1-13portbuster1337-CVE-2026-20182-a75f627/cve-2026-20182.py:74-168

Requirements

  • Target must be running a vulnerable version of Cisco Catalyst SD-WAN Controller or Manager with the vdaemon service exposed on UDP/12346.portbuster1337-CVE-2026-20182-a75f627/README.md:3portbuster1337-CVE-2026-20182-a75f627/README.md:67-81
  • Attacker must have network connectivity to the target's vdaemon UDP port (default 12346).portbuster1337-CVE-2026-20182-a75f627/cve-2026-20182.py:175-176
  • Python 3.7+, openssl CLI, and the cryptography library are required to run the exploit.portbuster1337-CVE-2026-20182-a75f627/README.md:111-113

Observed behavior

  • Establishes a DTLS 1.2 connection to the target's vdaemon service on UDP/12346.portbuster1337-CVE-2026-20182-a75f627/cve-2026-20182.py:79-84
  • Receives the CHALLENGE message (msg_type=8) from the server.portbuster1337-CVE-2026-20182-a75f627/cve-2026-20182.py:105-108
  • Sends a crafted CHALLENGE_ACK message with device_type=2 (vHub) to bypass certificate verification and set peer->authenticated = 1.portbuster1337-CVE-2026-20182-a75f627/cve-2026-20182.py:44-47portbuster1337-CVE-2026-20182-a75f627/cve-2026-20182.py:114-116
  • Sends a HELLO message (msg_type=5) to transition the peer to UP state.portbuster1337-CVE-2026-20182-a75f627/cve-2026-20182.py:50-51portbuster1337-CVE-2026-20182-a75f627/cve-2026-20182.py:144-146
  • Injects an SSH public key into /home/vmanage-admin/.ssh/authorized_keys via a MSG_VMANAGE_TO_PEER message (msg_type=14).portbuster1337-CVE-2026-20182-a75f627/cve-2026-20182.py:54-57portbuster1337-CVE-2026-20182-a75f627/cve-2026-20182.py:162-164
  • Optionally verifies exploitation by connecting to NETCONF (SSH TCP/830) as vmanage-admin using the injected key.portbuster1337-CVE-2026-20182-a75f627/cve-2026-20182.py:199-234
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Ssh Key Injection
The script injects an attacker-supplied or generated SSH public key into the target's authorized_keys file.This is the documented post-exploitation step to gain persistent access, consistent with the vulnerability description.portbuster1337-CVE-2026-20182-a75f627/cve-2026-20182.py:54-57portbuster1337-CVE-2026-20182-a75f627/cve-2026-20182.py:162-165
Network Connection
Connects to target UDP/12346 (vdaemon) and optionally TCP/830 (NETCONF) or TCP/22 (SSH).Standard exploit behavior for the described vulnerability.portbuster1337-CVE-2026-20182-a75f627/cve-2026-20182.py:79-84portbuster1337-CVE-2026-20182-a75f627/cve-2026-20182.py:200-211
Key Generation
Generates an ephemeral RSA key pair if no existing key is provided.Supports the documented SSH key injection step.portbuster1337-CVE-2026-20182-a75f627/cve-2026-20182.py:60-71portbuster1337-CVE-2026-20182-a75f627/cve-2026-20182.py:187-194
Review boundaries

What the analysis did not establish

  • Evidence is limited to the supplied text files; no binary analysis or runtime execution was performed.
  • The exploit relies on the openssl CLI for DTLS transport, which may have environment-specific dependencies not verified here.
  • Only the two supplied text files (README.md and cve-2026-20182.py) were reviewed; no other files exist in the artifact.
  • The script uses the openssl CLI subprocess for DTLS transport, which is a legitimate dependency for the exploit but could be abused if the openssl binary were compromised—no evidence of such compromise is present.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1