portbuster1337/CVE-2026-20182

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python exploit for CVE-2026-20182 that bypasses authentication on Cisco Catalyst SD-WAN Controller/Manager by sending crafted DTLS messages claiming to be a vHub (device_type=2), then injects an SSH public key for persistent NETCONF/SSH access.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Python exploit script for CVE-2026-20182. The script performs the documented authentication bypass and SSH key injection against the stated Cisco SD-WAN target. No concealed, deceptive, or unrelated harmful behavior was observed. The script's actions are consistent with the described exploit and do not exhibit backdoor or trojan characteristics.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareCisco Catalyst SD-WAN ControllerCisco Catalyst SD-WAN Manager
Attack typesauthentication bypassprivilege escalationremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a complete, executable Python script (cve-2026-20182.py) that actively exploits CVE-2026-20182 by sending crafted DTLS messages to bypass authentication and inject an SSH key for remote access. The README explicitly describes it as a 'proof-of-concept exploit' and details the exploitation steps.

README.md:3cve-2026-20182.py:1-13cve-2026-20182.py:74-168

Requirements

  • Python 3.7+ with cryptography library and openssl CLIREADME.md:111-113
  • Network access to target UDP port 12346 (vdaemon DTLS service)README.md:17

Observed behavior

  • Establishes DTLS 1.2 connection to target vdaemon service on UDP/12346cve-2026-20182.py:79-84
  • Receives CHALLENGE message (msg_type=8) from servercve-2026-20182.py:105-111
  • Sends CHALLENGE_ACK with device_type=2 (vHub) to bypass certificate verificationcve-2026-20182.py:44-47cve-2026-20182.py:114-116
  • Sends HELLO message to transition peer to UP statecve-2026-20182.py:50-51cve-2026-20182.py:144-146
  • Injects SSH public key into vmanage-admin authorized_keys via MSG_VMANAGE_TO_PEERcve-2026-20182.py:54-57cve-2026-20182.py:162-164
  • Optionally verifies exploitation by connecting to NETCONF over SSH on port 830cve-2026-20182.py:199-234
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
DTLS handshake, CHALLENGE_ACK with device_type=2, HELLO, SSH public key injection via MSG_VMANAGE_TO_PEERAll actions match the documented vulnerability exploitation steps and target the specified Cisco SD-WAN service.cve-2026-20182.py:39-57cve-2026-20182.py:74-168
Network Target
UDP/12346 (vdaemon DTLS service)The script connects only to the user-supplied target on the documented vulnerable service port.cve-2026-20182.py:79-80
Payload
SSH public key written to /home/vmanage-admin/.ssh/authorized_keysThe injected key provides the documented NETCONF/SSH access as the vmanage-admin user; no other payloads or persistence mechanisms are present.cve-2026-20182.py:54-57README.md:21-22
Review boundaries

What the analysis did not establish

  • Review is limited to the supplied text files (README.md and cve-2026-20182.py). No binary files were present. The script's runtime behavior was not dynamically analyzed; static analysis cannot guarantee the absence of logic bombs or environment-dependent behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1