CVE-2026-20131

GitHubCurated repository PoCScannerC++SecureWithUmer/CVE-2026-PoCs

PoC files

17 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Flask-based honeypot that emulates a Cisco FMC login page to detect and safely log Java deserialization attacks targeting CVE-2026-20131. It inspects incoming POST bodies for Java serialization magic bytes, extracts command-like strings and URLs using regex, optionally fetches second-stage payloads in a sandboxed manner, and logs events. It does not exploit the vulnerability.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence is a Flask-based honeypot that emulates a Cisco FMC login page, accepts POST data, inspects it for Java serialization magic bytes, extracts URLs and shell-like commands via regex, and optionally fetches second-stage payloads using requests with network safeguards. No backdoor, concealed operator-directed harm, or deceptive payload targeting the person running the PoC was observed.

ClassificationScanner
Model confidence98%
AuthenticationNot required
Languagespythonhtmljavascriptbash
Target softwareCisco Secure Firewall Management Center (FMC)
Attack typesdeserialization of untrusted data
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a honeypot that detects and logs Java deserialization attacks without exploiting the target vulnerability. It does not send a crafted serialized object to a real Cisco FMC device to achieve code execution; it only receives and inspects incoming payloads. This matches the scanner classification: code that checks for a vulnerability without exploiting it.

Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/app/app.py:1-3Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/app/parser.py:1-4

Requirements

  • Deploy the honeypot application to receive unsolicited attack traffic.Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/deploy.sh:1-17

Observed behavior

  • Serves a fake Cisco FMC login page on GET requests.Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/app/app.py:86-91
  • Inspects POST body for Java serialization magic bytes (0xACED0005) or base64-encoded equivalent.Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/app/app.py:98-106
  • Extracts shell-like commands (wget, curl, tftp, bash -c) and URLs from the serialized payload using regex without deserializing Java objects.Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/app/parser.py:93-157
  • Optionally fetches second-stage payloads from extracted URLs in a sandboxed manner (HTTP/HTTPS only, blocks private/reserved IPs).Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/app/harvester.py:95-133
  • Logs detection events to a JSON file and optionally sends Telegram alerts.Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/app/logger.py:52-90
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Honeypot Behavior
Flask app listens on 0.0.0.0, serves a fake Cisco FMC login page, and inspects POST bodies for Java serialized objects.The artifact is explicitly documented as a honeypot trap for CVE-2026-20131 exploitation attempts, not a backdoor.Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/app/app.py:1-3Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/app/app.py:83-153
Second Stage Fetch
safe_fetch() downloads URLs extracted from payloads using requests, with IP/host blocking for private, loopback, link-local, multicast, and reserved addresses.The fetch is a documented honeypot feature to collect attacker payloads; it does not execute them and includes safeguards against internal network access.Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/app/harvester.py:1-3Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/app/harvester.py:44-71Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/app/harvester.py:95-133
Telegram Notification
Optional Telegram alerts via TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID environment variables.This is a standard honeypot notification mechanism, not a backdoor; it requires explicit operator configuration.Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/app/logger.py:36-49Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/app/logger.py:85-90
Review boundaries

What the analysis did not establish

  • complete_artifact_coverage is false; 10 unclassified files (14445 bytes) are present but not included in the text evidence, so the analysis is based solely on the 7 provided text files.
  • 10 unclassified files (14445 bytes) were not analyzed; they are flagged as metadata-only and could contain unobserved content.
  • The review is limited to the supplied text evidence; no runtime behavior or external dependencies were examined.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

2026/CVE-2026-20131/Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/docker-compose.yml

Created Vuln labCVE-2026-20131Compose · mixed

1 Compose manifest · 1 Dockerfile · 2 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A low-interaction honeypot that mimics a Cisco Secure Firewall Management Center (FMC) web surface to capture unauthenticated Java deserialization probes. It consists of a Flask/Gunicorn application behind a Caddy reverse proxy with TLS, logging events and optionally fetching second-stage payloads via HTTP.

2026/CVE-2026-20131/Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/README.md:1-52026/CVE-2026-20131/Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/docker-compose.yml:1-42

Lab assessment

Vulnerability lab

The README explicitly states the project is a honeypot for capturing CVE-style insecure deserialization probes, and the code detects Java serialization magic bytes and extracts commands/URLs without executing them. The environment is designed for security research on a specific vulnerability class.

2026/CVE-2026-20131/Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/README.md:1-5
Lab shapeCompose · mixed
Services2
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

fmc-trap

honeypot web applicationJava deserialization probe detectorsecond-stage payload harvester

A Flask application served by Gunicorn that presents a fake Cisco FMC login page. On POST requests, it inspects the body for Java serialization magic bytes (hex AC ED 00 05 or Base64 rO0AB). If detected, it extracts shell-like commands and URLs using regex, logs the event, optionally fetches allowed URLs via HTTP, and saves the raw payload. It never deserializes Java objects or executes commands.

2026/CVE-2026-20131/Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/app/app.py:1-1532026/CVE-2026-20131/Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/app/parser.py:1-1652026/CVE-2026-20131/Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/app/harvester.py:1-2012026/CVE-2026-20131/Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/app/logger.py:1-90

caddy

TLS terminationreverse proxyACME/Let's Encrypt client

A Caddy 2 reverse proxy that listens on ports 80 and 443, obtains TLS certificates automatically via Let's Encrypt, and forwards requests to the fmc-trap service on port 5000. It uses public DNS resolvers to ensure ACME lookups succeed inside Docker.

2026/CVE-2026-20131/Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/docker-compose.yml:22-382026/CVE-2026-20131/Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/Caddyfile:1-12
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-20131

Insufficient evidence

The packet contains no CVE description, advisory, or exploit code that confirms CVE-2026-20131. The unit path includes the CVE ID, and the README mentions 'CVE-style insecure deserialization probes,' but no specific vulnerability details or proof of association are provided.

2026/CVE-2026-20131/Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/README.md:1-5
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose v2 installed on the host.2026/CVE-2026-20131/Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/README.md:11-12
  • A domain name with DNS A/AAAA records pointing to the host's public IP, and inbound TCP ports 80 and 443 allowed.2026/CVE-2026-20131/Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/README.md:13-142026/CVE-2026-20131/Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/README.md:47-49
  • Host directories data/logs and data/downloads must be writable by UID 10001 (the container user).2026/CVE-2026-20131/Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/README.md:52-56
  • Caddyfile must be edited to replace example.com with the operator's domain.2026/CVE-2026-20131/Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/README.md:37-42

Evidence-described exercise path

  1. Clone the repository and navigate to the project directory.2026/CVE-2026-20131/Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/README.md:19-22
  2. Copy .env.example to .env and configure environment variables (e.g., TRUST_X_FORWARDED_FOR=1).2026/CVE-2026-20131/Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/README.md:24-28
  3. Edit Caddyfile to replace placeholder domains with the operator's domain.2026/CVE-2026-20131/Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/README.md:37-42
  4. Ensure DNS records and firewall rules allow inbound traffic on ports 80 and 443.2026/CVE-2026-20131/Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/README.md:47-49
  5. Create data directories and set ownership to UID 10001.2026/CVE-2026-20131/Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/README.md:52-56
  6. Start the stack with 'docker compose up -d --build'.2026/CVE-2026-20131/Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/README.md:58-60
  7. Verify the honeypot is reachable via HTTPS and displays the fake FMC login page.2026/CVE-2026-20131/Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/README.md:62-66
  8. Send POST requests containing Java serialized payloads to the honeypot to trigger detection, logging, and optional second-stage harvesting.2026/CVE-2026-20131/Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/app/app.py:88-145
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The application is a honeypot that only inspects and logs incoming payloads; it never deserializes Java objects or executes extracted commands. Second-stage fetching is restricted to HTTP/HTTPS, blocks private/reserved IPs, and saves files with read-only permissions. No behavior targets the host, persists beyond the container, steals credentials, or acts as a backdoor. The Caddy reverse proxy is a standard TLS termination component. All observed behavior is consistent with a contained vulnerability-research lab.

2026/CVE-2026-20131/Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/app/app.py:1-1532026/CVE-2026-20131/Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/app/harvester.py:1-2012026/CVE-2026-20131/Hassan-Pouladi-Cisco-FMC-honeypot-3cee925/app/parser.py:1-165
Review boundaries

What the analysis did not establish

  • No CVE description or exploit code is included; CVE-2026-20131 association is based solely on the directory name and README mention of 'CVE-style' probes.
  • The .env.example file is not included in evidence_files, so default environment variable values are unknown.
  • The packet does not contain any sample attack payloads or test scripts to demonstrate the exercise.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1