Cisco Secure Firewall Management Center pre-auth root RCE via static csm_processes session fixation

#!/usr/bin/env bash
# check_cve_2026_20079.sh — Cisco FMC CVE-2026-20079 vulnerability checker
# Run as root on the FMC appliance itself.
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

RESULT="UNKNOWN"

# Get FMC version
if [ -f /etc/sf/ims.conf ]; then
  VERSION=$(grep 'SWVERSION=' /etc/sf/ims.conf 2>/dev/null | head -1 | cut -d'=' -f2 | tr -d '"' || true)
elif command -v sf_version &>/dev/null; then
  VERSION=$(sf_version 2>/dev/null | grep -oP '[0-9]+\.[0-9]+\.[0-9]+' | head -1 || true)
else
  VERSION=""
fi

if [ -z "$VERSION" ]; then
  echo "[!] Could not determine FMC software version."
  echo "UNKNOWN"
  exit 2
fi

echo "[*] Detected FMC version: $VERSION"

# Parse version components
IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"

# Check against known-vulnerable ranges
# Fixed: 7.0.9+, 7.2.11+, 7.4.6+, 7.6.5+, 7.7.12+, 10.0.1+
vuln=0

if [ "$MAJOR" -eq 6 ]; then
  vuln=1  # All 6.x affected
elif [ "$MAJOR" -eq 7 ]; then
  if [ "$MINOR" -eq 0 ] && [ "$PATCH" -lt 9 ]; then
    vuln=1  # 7.0.x before 7.0.9
  elif [ "$MINOR" -eq 1 ]; then
    vuln=1  # 7.1.x all affected
  elif [ "$MINOR" -eq 2 ] && [ "$PATCH" -lt 11 ]; then
    vuln=1  # 7.2.x before 7.2.11
  elif [ "$MINOR" -eq 3 ]; then
    vuln=1  # 7.3.x all affected
  elif [ "$MINOR" -eq 4 ] && [ "$PATCH" -lt 6 ]; then
    vuln=1  # 7.4.x before 7.4.6
  elif [ "$MINOR" -eq 6 ] && [ "$PATCH" -lt 5 ]; then
    vuln=1  # 7.6.x before 7.6.5
  elif [ "$MINOR" -eq 7 ] && [ "$PATCH" -lt 12 ]; then
    vuln=1  # 7.7.x before 7.7.12
  fi
elif [ "$MAJOR" -eq 10 ]; then
  if [ "$MINOR" -eq 0 ] && [ "$PATCH" -lt 1 ]; then
    vuln=1  # 10.0.0
  fi
fi

# Check for the exploitable session in database
SESS_DB="/var/sf/peers/*/sfsnort.sessions"
session_present=0
for db in $SESS_DB; do
  if [ -f "$db" ]; then
    if sqlite3 "$db" "SELECT COUNT(*) FROM sessions WHERE session_id='csm_processes';" 2>/dev/null | grep -q '[1-9]'; then
      session_present=1
      echo "[!] ACTIVE csm_processes session found in: $db"
    fi
  fi
done

# Check for IOCs
ioc_found=0
if [ -f /var/tmp/license.tmp ]; then
  echo "[!] IOC: /var/tmp/license.tmp exists — possible exploitation artifact"
  ioc_found=1
fi
if find /opt/cisco/fp/tomcat -name 'cmd.jar' 2>/dev/null | grep -q .; then
  echo "[!] IOC: cmd.jar found in Tomcat directory — possible web shell"
  ioc_found=1
fi

# Check for patched Apache config (the fix adds X-Auth-User-Type header)
patched_apache=0
if grep -rq 'X-Auth-User-Type' /etc/httpd/conf* /etc/apache2/* 2>/dev/null; then
  patched_apache=1
  echo "[+] Apache header validation for X-Auth-User-Type detected (patch indicator)"
fi

# Determine result
if [ $vuln -eq 1 ] && [ $patched_apache -eq 0 ]; then
  RESULT="VULNERABLE"
  echo "[!!] Version $VERSION is in the vulnerable range and patch indicator not found."
  if [ $session_present -eq 1 ]; then
    echo "[!!] CRITICAL: Exploitable session is ACTIVE. Immediate patching required."
  fi
  if [ $ioc_found -eq 1 ]; then
    echo "[!!] CRITICAL: Indicators of compromise detected. Initiate IR."
  fi
elif [ $patched_apache -eq 1 ]; then
  RESULT="PATCHED"
  echo "[+] Patch indicators present. Version: $VERSION"
elif [ $vuln -eq 0 ]; then
  RESULT="PATCHED"
  echo "[+] Version $VERSION is at or above the fixed version."
else
  RESULT="UNKNOWN"
  echo "[?] Could not conclusively determine patch status."
fi

echo ""
echo "$RESULT"

case $RESULT in
  PATCHED)    exit 0 ;;
  VULNERABLE) exit 1 ;;
  *)          exit 2 ;;
esac