Cisco Catalyst SD-WAN Controller and Manager peering authentication bypass

#!/usr/bin/env bash
# check_cve_2026_20127.sh
# Determine likely exposure to CVE-2026-20127 on Cisco Catalyst SD-WAN control components.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

trim() {
  sed 's/^[[:space:]]*//;s/[[:space:]]*$//'
}

ver_lt() {
  # returns 0 if $1 < $2
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" != "$2" ] && return 1
  [ "$1" = "$2" ] && return 1
  return 0
}

ver_ge() {
  [ "$1" = "$2" ] && return 0
  ver_lt "$1" "$2" && return 1
  return 0
}

extract_version() {
  local out=""

  # Try common local files first
  for f in /etc/cisco-release /opt/viptela/etc/version /etc/viptela/version /etc/issue; do
    if [ -r "$f" ]; then
      out=$(grep -Eo '[0-9]+\.[0-9]+(\.[0-9]+){0,2}([a-z])?' "$f" 2>/dev/null | head -n1)
      if [ -n "$out" ]; then
        echo "$out"
        return 0
      fi
    fi
  done

  # Try CLI commands if present in PATH
  if command -v show >/dev/null 2>&1; then
    out=$(show version 2>/dev/null | grep -Eo '[0-9]+\.[0-9]+(\.[0-9]+){0,2}([a-z])?' | head -n1)
    if [ -n "$out" ]; then
      echo "$out"
      return 0
    fi

    out=$(show boot-partition 2>/dev/null | grep -Eo '[0-9]+\.[0-9]+(\.[0-9]+){0,2}([a-z])?' | head -n1)
    if [ -n "$out" ]; then
      echo "$out"
      return 0
    fi
  fi

  # Last resort: broad local search in likely config paths
  out=$(grep -RhoE '[0-9]+\.[0-9]+(\.[0-9]+){0,2}([a-z])?' /etc /opt 2>/dev/null | head -n1)
  if [ -n "$out" ]; then
    echo "$out"
    return 0
  fi

  return 1
}

is_vulnerable() {
  local v="$1"

  # Normalize obvious branch names by checking prefixes and fixed release thresholds from Cisco advisory.
  case "$v" in
    20.9*)
      ver_lt "$v" "20.9.8.2" && return 0 || return 1
      ;;
    20.11*)
      ver_lt "$v" "20.12.6.1" && return 0 || return 1
      ;;
    20.12.6)
      return 0
      ;;
    20.12*)
      ver_lt "$v" "20.12.5.3" && return 0 || return 1
      ;;
    20.13*|20.14*|20.15*)
      ver_lt "$v" "20.15.4.2" && return 0 || return 1
      ;;
    20.16*|20.18*)
      ver_lt "$v" "20.18.2.1" && return 0 || return 1
      ;;
    20.[0-8]*|19.*|18.*|17.*|16.*|15.*|14.*|13.*|12.*|11.*|10.*)
      # Cisco says earlier than 20.9 must migrate to a fixed release.
      return 0
      ;;
    *)
      # Unknown / unsupported / unexpected train.
      return 2
      ;;
  esac
}

VERSION=$(extract_version | trim)

if [ -z "$VERSION" ]; then
  echo "UNKNOWN - could not determine installed Cisco SD-WAN version"
  exit 2
fi

is_vulnerable "$VERSION"
RC=$?

case "$RC" in
  0)
    echo "VULNERABLE - detected version $VERSION matches Cisco vulnerable ranges for CVE-2026-20127"
    exit 1
    ;;
  1)
    echo "PATCHED - detected version $VERSION is at or beyond Cisco first fixed release for its train"
    exit 0
    ;;
  *)
    echo "UNKNOWN - detected version $VERSION does not map cleanly to Cisco advisory ranges"
    exit 2
    ;;
esac