Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

#!/usr/bin/env bash
# CVE-2026-20182 Cisco Catalyst SD-WAN version checker
# Usage:
#   bash cve-2026-20182-check.sh --version 20.12.6.1
#   bash cve-2026-20182-check.sh            # best-effort auto-detect via 'show version'
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

set -u

ver=""

if [[ $# -ge 2 && "$1" == "--version" ]]; then
  ver="$2"
elif command -v show >/dev/null 2>&1; then
  # Best-effort parse from local CLI output
  ver=$(show version 2>/dev/null | grep -Eo '([0-9]+\.){1,4}[0-9]+' | head -n1 || true)
fi

if [[ -z "$ver" ]]; then
  echo "UNKNOWN: unable to determine version; rerun with --version <x.y.z>"
  exit 2
fi

# Compare dotted numeric versions.
vercmp() {
  local IFS=.
  local i
  local -a a=($1) b=($2)
  local len=${#a[@]}
  if (( ${#b[@]} > len )); then len=${#b[@]}; fi
  for ((i=0; i<len; i++)); do
    local ai=${a[i]:-0}
    local bi=${b[i]:-0}
    ((10#$ai > 10#$bi)) && return 1
    ((10#$ai < 10#$bi)) && return 2
  done
  return 0
}

lt() { vercmp "$1" "$2"; [[ $? -eq 2 ]]; }
ge() { vercmp "$1" "$2"; [[ $? -eq 0 || $? -eq 1 ]]; }

status="UNKNOWN"
reason="unrecognized release family"

# Cisco-managed cloud fixed release
if [[ "$ver" == "20.15.506" ]]; then
  status="PATCHED"
  reason="Cisco-managed cloud fixed release"

elif lt "$ver" "20.9"; then
  status="VULNERABLE"
  reason="earlier than 20.9 per Cisco advisory"

elif ge "$ver" "20.9" && lt "$ver" "20.10"; then
  if lt "$ver" "20.9.9.1"; then
    status="VULNERABLE"
    reason="20.9 family fixed at 20.9.9.1"
  else
    status="PATCHED"
    reason="20.9 family at or above 20.9.9.1"
  fi

elif ge "$ver" "20.10" && lt "$ver" "20.12"; then
  status="VULNERABLE"
  reason="20.10/20.11 require migration to fixed 20.12.7.1 or later supported release"

elif ge "$ver" "20.12" && lt "$ver" "20.13"; then
  if lt "$ver" "20.12.5.4"; then
    status="VULNERABLE"
    reason="20.12 up to 20.12.5.3 fixed at 20.12.5.4"
  elif ge "$ver" "20.12.6" && lt "$ver" "20.12.6.2"; then
    status="VULNERABLE"
    reason="20.12.6.x fixed at 20.12.6.2"
  elif ge "$ver" "20.12.7" && lt "$ver" "20.12.7.1"; then
    status="VULNERABLE"
    reason="20.12.7 fixed at 20.12.7.1"
  else
    status="PATCHED"
    reason="20.12 family at or above a fixed maintenance release"
  fi

elif ge "$ver" "20.13" && lt "$ver" "20.15"; then
  status="VULNERABLE"
  reason="20.13/20.14 require migration to fixed 20.15.5.2 or later supported release"

elif ge "$ver" "20.15" && lt "$ver" "20.16"; then
  if lt "$ver" "20.15.4.4"; then
    status="VULNERABLE"
    reason="20.15 up to 20.15.4.3 fixed at 20.15.4.4"
  elif ge "$ver" "20.15.5" && lt "$ver" "20.15.5.2"; then
    status="VULNERABLE"
    reason="20.15.5.x fixed at 20.15.5.2"
  else
    status="PATCHED"
    reason="20.15 family at or above a fixed maintenance release"
  fi

elif ge "$ver" "20.16" && lt "$ver" "20.18"; then
  status="VULNERABLE"
  reason="20.16/20.17 require migration to fixed 20.18.2.2 or later supported release"

elif ge "$ver" "20.18" && lt "$ver" "26.1"; then
  if lt "$ver" "20.18.2.2"; then
    status="VULNERABLE"
    reason="20.18 family fixed at 20.18.2.2"
  else
    status="PATCHED"
    reason="20.18 family at or above 20.18.2.2"
  fi

elif ge "$ver" "26.1" && lt "$ver" "27.0"; then
  if lt "$ver" "26.1.1.1"; then
    status="VULNERABLE"
    reason="26.1 family fixed at 26.1.1.1"
  else
    status="PATCHED"
    reason="26.1 family at or above 26.1.1.1"
  fi
fi

case "$status" in
  VULNERABLE)
    echo "VULNERABLE: $ver ($reason)"
    exit 1
    ;;
  PATCHED)
    echo "PATCHED: $ver ($reason)"
    exit 0
    ;;
  *)
    echo "UNKNOWN: $ver ($reason)"
    exit 2
    ;;
esac