0xreadingsteiner/cisco-security-researchIndependent security research on Cisco products — CUCM, Expressway, FTD, ISE
Researcher: 0xReadingSteiner Contact: [email protected] Vendor: Cisco Systems, Inc. Vendor Notified: 2026-08-04 (Cisco PSIRT, ZDI, SSD) Vendor Response: None
Independent security research on commercially available Cisco products has identified critical vulnerabilities across multiple product lines — including the systems enterprises rely on for voice communications, collaboration, and network security.
Multiple coordination attempts were made before publication:
Cisco's refusal to engage leaves enterprise defenders blind. These advisories exist so that organizations running Cisco infrastructure can assess their own risk and take protective action.
| Product | Role | Status |
|---|---|---|
| Cisco Unified Communications Manager (CUCM) 15.x | Enterprise voice call processing | Active — 55+ vulnerabilities identified, 3 kill chains published (incl. cross-product False;Relay) |
| Cisco Expressway X14.x / X15.x | Collaboration edge / traversal proxy | Active — Blind;Wire (pre-auth SIP smuggling) + False;Relay (MRA corridor chain) + Null;Tone (pre-auth component-bus saturation, C and E) published |
| Cisco Firepower Threat Defense (FTD) | Next-gen firewall / IPS | Upcoming |
Each advisory combines multiple vulnerabilities into a complete attack narrative.
| # | Name | Components | Summary | CVSSv3.1 | Date |
|---|---|---|---|---|---|
| 01 | Silent;Call | Spoofhack → Keyhack → Roothack | Pre-authentication remote root — 3 HTTP requests, zero credentials | 10.0 | 2026-08-04 |
| 03 | Dead;Dial | Spoofhack → Deployhack → Lookaphack | Pre-auth RCE via 2006-era Apache Axis AdminService + JNDI injection in WebDialer — survives Tomcat Manager credential rotation | 10.0 | 2026-08-10 |
| # | Name | Components | Summary | CVSSv3.1 | Date |
|---|---|---|---|---|---|
| 02 | Blind;Wire | Zerohack | Pre-authentication SIP request smuggling — Content-Length: 2³² wraps to 0, turning the edge proxy into a policy-blind tunnel | 8.1 | 2026-08-10 |
| 05 | Null;Tone | Squathack → Burnhack | Pre-auth XCP component-bus blackout on both C and E — name-squat any component id + Θ(n²) depth-bomb (limits hardcoded 0/0, no operator knob) saturates both cores at ~10 KB/s sustained; :7400 has no fail2ban coverage; live-verified 2026-10-05 on two production-version appliances (ΔCPU +218.6 s / +92 s, probes 0.00 s→18.18 s, clean pid-continuous recovery) | 8.2 | 2026-10-05 |
| # | Name | Components | Summary | CVSSv3.1 | Date |
|---|---|---|---|---|---|
| 04 | False;Relay | Blankhack → Seedhack → corridor → Badgehack (＋ Splithack / Wraphack / Namehack) | MRA corridor abuse — presence-only edge gate + zero-auth relay-credential seeding + cluster-key identity forgery: internet-origin pre-auth CUCM data (200 live UDS XML) and forged-Bearer SSO-session acceptance, proven live end-to-end on both a seeded path and a pure-real-credential path. 2026-09-28 extension: the UDS user-resource gate resolved — a sub-matched forged token reads any user's record and writes its PIN/credentials from the internet (204, database-verified); per-user account takeover, silent, all-2xx. Zero fail2ban ticks on the success path. | 10.0 (composed) / 8.5 (one MRA account) | 2026-09-28 |
Additional kill chains will be published on a rolling basis.
Each kill chain is composed of individual vulnerabilities, documented separately for CVE tracking.
| ID | Name | Title | CWE | Used In |
|---|---|---|---|---|
| SKYLINE-2026-001 | Spoofhack | X-Forwarded-For Header Trust Without Restriction | CWE-644 | Silent;Call, Dead;Dial |
| SKYLINE-2026-002 | Keyhack | Hardcoded Tomcat Manager Credentials | CWE-798 | Silent;Call |
| SKYLINE-2026-003 | Roothack | Multiple Unrestricted Sudo Privilege Escalation Paths | CWE-269 | Silent;Call |
| SKYLINE-2026-057a | Deployhack | Apache Axis AdminService Arbitrary Class Deployment | CWE-306 | Dead;Dial |
| SKYLINE-2026-057b | Lookaphack | JNDI Injection via Deployed SOAP Service | CWE-502 | Dead;Dial |
| SKYLINE-2026-004 | Badgehack | Forged Bearer Access-Token Acceptance via Cluster-Key Identity Forgery | CWE-287 | False;Relay |
| ID | Name | Title | CWE | Used In |
|---|---|---|---|---|
| SKYLINE-2026-056 | Zerohack | Content-Length Integer Overflow (2³² → 0) in SIP Parser | CWE-190 | Blind;Wire |
| SKYLINE-2026-005 | Blankhack | Presence-Only Session-Cookie Gate on the Internet-Facing MRA Edge | CWE-287 | False;Relay |
| SKYLINE-2026-006 | Seedhack | Zero-Auth Relay-Credential Seeding via Expressway-C CDB | CWE-306 | False;Relay |
| SKYLINE-2026-007 | Splithack | Chunk-Extension Request Smuggling Live on the MRA Edge (CVE-2026-24033/57834 class) | CWE-444 | False;Relay |
| SKYLINE-2026-008 | Wraphack | Content-Length int64 Wraparound + Backend-Leg Smuggled-Request Delivery | CWE-190 | False;Relay |
| SKYLINE-2026-009 | Namehack | uint16 Header-Name Truncation / Aliasing Across the Full MRA Chain (CVE-2026-58155 class) | CWE-197 | False;Relay |
| SKYLINE-2026-010 | Squathack | Pre-Auth Component-Name Claim on the Externally Bound XCP Bus (:7400) | CWE-306 | Null;Tone |
| SKYLINE-2026-011 | Burnhack | Pre-Auth Θ(n²) XML Depth Saturation of the Whole Appliance via :7400 | CWE-400 / CWE-407 | Null;Tone |
Assessment tools published alongside the research. Defensive framing; require legitimate access or explicit authorization.
