Nxploited/CVE-2026-20182

GitHubRepository PoCExploit

PoC files

5 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python 3 exploit framework for CVE-2026-20182 that performs an authentication bypass on Cisco Catalyst SD-WAN Controller/Manager via crafted DTLS handshake messages, injects an SSH public key, and verifies SSH access to achieve remote code execution.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python exploit script (CVE-2026-20182.py), a README.md, and a requirements.txt file. The script implements a proof-of-concept for CVE-2026-20182, a Cisco SD-WAN authentication bypass. It performs DTLS handshakes, sends crafted protocol messages, optionally injects an SSH public key, and verifies SSH access. No concealed backdoor, unrelated remote access, persistence mechanism, or deceptive payload targeting the person running the PoC was observed. The code's behavior is consistent with the stated vulnerability exploitation and assessment purpose.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagespython
Target softwareCisco Catalyst SD-WAN ControllerCisco Catalyst SD-WAN Manager
Attack typesauthentication_bypassremote_code_execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains code that actively exploits CVE-2026-20182 by sending crafted network messages to bypass authentication, inject an SSH key, and establish remote access. This is confirmed by the README description and the perform_exploit_attempt function which implements the full attack chain.

README.md:57-73CVE-2026-20182.py:1255-1408

Requirements

  • Requires Python 3.9+ with cryptography and rich libraries, and OpenSSL 3.x/4.x shared libraries.requirements.txt:1-6README.md:97-101
  • Requires a target list file with IP addresses or hostnames of vulnerable Cisco SD-WAN controllers.README.md:284-307

Observed behavior

  • Establishes a DTLS connection to the target on UDP port 12346.CVE-2026-20182.py:1085-1135
  • Sends a crafted CHALLENGE_ACK message as a vHub (type 2) to bypass peering authentication.CVE-2026-20182.py:1303-1304
  • Completes a Hello exchange to confirm the bypass.CVE-2026-20182.py:1315-1327
  • Injects an attacker-generated SSH public key via a VMANAGE_TO_PEER message.CVE-2026-20182.py:1337-1338
  • Verifies SSH access as vmanage-admin on TCP port 830 (NETCONF) using the injected key.CVE-2026-20182.py:1364-1377
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Ssh Key Generation And Injection
The script generates an RSA key pair and injects the public key into the target via the SD-WAN protocol (lines 337-338, 758-777).This is the core exploit mechanism for CVE-2026-20182, enabling unauthorized SSH access to the target device. It is not a backdoor against the operator.CVE-2026-20182.py:337-338CVE-2026-20182.py:758-777
Ssh Verification
The script attempts to log in to the target via SSH using the injected key (lines 809-895).This verifies the exploit's success against the target, not against the operator's machine.CVE-2026-20182.py:809-895
Output Files
The script writes results, SSH keys, and connection commands to local files (lines 68-74, 481-571).These are standard output artifacts for an assessment tool. No evidence of exfiltration or hidden data collection.CVE-2026-20182.py:68-74CVE-2026-20182.py:481-571
Author Contact
Telegram: @KNxploited (README.md line 39)Author contact information is present but does not constitute backdoor behavior.README.md:39
Review boundaries

What the analysis did not establish

  • Evidence includes only selected text files; one non-text media file (Nx.png) and one text file (LICENSE) are omitted.
  • complete_artifact_coverage is false; the repository contains 5 files, but only 3 text files are fully included.
  • One non-text media file (Nx.png, 57281 bytes) was flagged as metadata-only and not analyzed for steganography or hidden payloads.
  • One unclassified file (1505 bytes) was not analyzed.
  • The review is limited to the supplied text evidence; no dynamic analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1