Cisco Catalyst SD-WAN Controller Authentication Bypass

MetasploitMetasploit auxiliary PoCExploitRubyauxiliary_admin/networking/cisco_sdwan_auth_bypass

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

This Metasploit auxiliary module exploits CVE-2026-20127, an authentication bypass in Cisco Catalyst SD-WAN Controller. It performs a DTLS handshake with a self-signed certificate, sends a forged CHALLENGE_ACK_ACK message with verify_status=1 to become a trusted peer, and then injects an SSH public key into the vmanage-admin authorized_keys file via a VMANAGE_TO_PEER message for persistent access.

Backdoor review

No backdoor observed in reviewed code

The module is a standard Metasploit auxiliary exploit for CVE-2026-20127. It performs a DTLS handshake, sends a crafted CHALLENGE_ACK_ACK to bypass authentication, and optionally injects an SSH public key for persistent access. All behavior is consistent with the documented exploit purpose; no concealed backdoor, unrelated payload, or operator-directed harm is present.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagesruby
Target softwareCisco Catalyst SD-WAN ControllerCisco SD-WAN vSmartCisco SD-WAN vBond
Attack typesauthentication_bypassssh_key_injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module actively exploits the vulnerability by sending a crafted CHALLENGE_ACK_ACK message to bypass authentication and then injects an SSH key for persistent access, which constitutes exploitation rather than mere detection or scanning.

modules/auxiliary/admin/networking/cisco_sdwan_auth_bypass.rb:20-36modules/auxiliary/admin/networking/cisco_sdwan_auth_bypass.rb:198-203modules/auxiliary/admin/networking/cisco_sdwan_auth_bypass.rb:248-256

Requirements

  • Network access to the target's DTLS control-plane service on the configured port (default 12346).modules/auxiliary/admin/networking/cisco_sdwan_auth_bypass.rb:58
  • OpenSSL libraries available on the attacker's system for DTLS FFI bindings.modules/auxiliary/admin/networking/cisco_sdwan_auth_bypass.rb:510-511

Observed behavior

  • Generates a self-signed certificate in memory and performs a DTLS 1.2 handshake with the target, disabling peer certificate verification.modules/auxiliary/admin/networking/cisco_sdwan_auth_bypass.rb:125modules/auxiliary/admin/networking/cisco_sdwan_auth_bypass.rb:141-142
  • Receives a CHALLENGE message from the server.modules/auxiliary/admin/networking/cisco_sdwan_auth_bypass.rb:180-196
  • Sends a forged CHALLENGE_ACK_ACK message with verify_status=1 to bypass authentication.modules/auxiliary/admin/networking/cisco_sdwan_auth_bypass.rb:198-203
  • Sends a Hello message to complete peering as an authenticated peer.modules/auxiliary/admin/networking/cisco_sdwan_auth_bypass.rb:224-228
  • Injects an SSH public key into the vmanage-admin authorized_keys file by sending a VMANAGE_TO_PEER message, enabling persistent SSH access.modules/auxiliary/admin/networking/cisco_sdwan_auth_bypass.rb:248-256
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Authentication bypass via crafted CHALLENGE_ACK_ACK (msg_type=10) with verify_status=1Core exploit mechanism documented in the module description and CVE context.modules/auxiliary/admin/networking/cisco_sdwan_auth_bypass.rb:198-203
Exploit Behavior
SSH public key injection into vmanage-admin authorized_keys via VMANAGE_TO_PEER messagePost-exploitation persistence mechanism consistent with the module's stated purpose.modules/auxiliary/admin/networking/cisco_sdwan_auth_bypass.rb:248-256
Exploit Behavior
Self-signed certificate generation and DTLS handshake with no peer verificationNecessary to establish the DTLS control-plane connection as described in the vulnerability analysis.modules/auxiliary/admin/networking/cisco_sdwan_auth_bypass.rb:119-178
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the provided module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
  • No runtime behavior or network traffic was observed; classification is based on static code analysis of the module's intended operation.
  • Review is limited to the module source and metadata; Metasploit framework mixins, libraries, and external payloads are not expanded or analyzed.
  • Binary files are not inspected; the evidence contains no binary files.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1