Cisco SG350 and SG350X Series Managed Switches SNMP Denial of Service Vunerability

#!/usr/bin/env python3
# check_cve_2026_20185.py
# Determine likely exposure to CVE-2026-20185 on Cisco SG350 / SG350X switches.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED(or not affected/mitigated), 1=VULNERABLE, 2=UNKNOWN

import re
import sys
import subprocess

USAGE = "Usage: python3 check_cve_2026_20185.py user@host [--ssh-opt=<value> ...]"


def run_ssh(target, cmd, extra_opts):
    base = ["ssh", "-o", "BatchMode=yes", "-o", "ConnectTimeout=10"]
    for opt in extra_opts:
        base.extend([opt] if opt.startswith("-") and " " not in opt else [opt])
    full = base + [target, cmd]
    try:
        p = subprocess.run(full, capture_output=True, text=True, timeout=25)
    except Exception as e:
        return None, f"ssh execution failed: {e}"
    if p.returncode != 0:
        err = (p.stderr or p.stdout or "ssh returned non-zero").strip()
        return None, err
    return p.stdout, None


def main():
    if len(sys.argv) < 2:
        print("UNKNOWN - " + USAGE)
        sys.exit(2)

    target = sys.argv[1]
    extra_opts = []
    for arg in sys.argv[2:]:
        if arg.startswith("--ssh-opt="):
            extra_opts.append(arg.split("=", 1)[1])
        else:
            print(f"UNKNOWN - unrecognized argument: {arg}")
            sys.exit(2)

    commands = {
        "version": "show version",
        "snmp_community": "show running-config | include snmp-server community",
        "snmp_group": "show running-config | include snmp-server group",
        "snmp_user": "show snmp user",
        "poe": "show running-config | include interface|power inline limit 60000",
        "view": "show running-config | include snmp-server view",
    }

    out = {}
    for key, cmd in commands.items():
        data, err = run_ssh(target, cmd, extra_opts)
        if err is not None:
            print(f"UNKNOWN - failed '{cmd}': {err}")
            sys.exit(2)
        out[key] = data or ""

    version_text = out["version"]
    model_match = re.search(r"\bSG350X?[-A-Z0-9]*\b", version_text, re.IGNORECASE)
    version_match = re.search(r"\b2\.5\.9\.(54|55)\b", version_text)

    if not model_match:
        print("PATCHED - target does not appear to be an SG350/SG350X switch")
        sys.exit(0)

    model = model_match.group(0).upper()
    affected_version = bool(version_match)

    snmp_v12 = "snmp-server community" in out["snmp_community"].lower()
    snmp_v3 = ("snmp-server group" in out["snmp_group"].lower()) and ("user name:" in out["snmp_user"].lower())
    snmp_enabled = snmp_v12 or snmp_v3

    poe_60w_count = len(re.findall(r"power inline limit 60000", out["poe"], re.IGNORECASE))
    poe_gate = poe_60w_count >= 2

    view_text = out["view"]
    oid_excluded = bool(re.search(r"snmp-server view\s+\S+\s+rlPethPsePortTable\s+excluded", view_text, re.IGNORECASE))
    view_created = bool(re.search(r"snmp-server view\s+\S+\s+iso\s+included", view_text, re.IGNORECASE))

    # Try to identify whether a mitigated view is actually applied.
    applied_to_v12 = bool(re.search(r"snmp-server community\s+\S+\s+view\s+\S+\s+RO", out["snmp_community"], re.IGNORECASE))
    applied_to_v3 = bool(re.search(r"snmp-server group\s+\S+\s+v3\s+\S*\s*read\s+\S+\s+write\s+\S+", out["snmp_group"], re.IGNORECASE))
    mitigation_present = oid_excluded and view_created and (applied_to_v12 or applied_to_v3)

    reasons = []
    reasons.append(f"model={model}")
    reasons.append(f"affected_version={'yes' if affected_version else 'no'}")
    reasons.append(f"snmp_enabled={'yes' if snmp_enabled else 'no'}")
    reasons.append(f"60w_poe_ports={poe_60w_count}")
    reasons.append(f"mitigation_present={'yes' if mitigation_present else 'no'}")

    if not affected_version:
        print("PATCHED - not on firmware 2.5.9.54/2.5.9.55; " + ", ".join(reasons))
        sys.exit(0)

    if not snmp_enabled:
        print("PATCHED - SNMP not enabled; " + ", ".join(reasons))
        sys.exit(0)

    if not poe_gate:
        print("PATCHED - fewer than two 60W PoE ports configured; " + ", ".join(reasons))
        sys.exit(0)

    if mitigation_present:
        print("PATCHED - Cisco OID-exclusion mitigation detected; " + ", ".join(reasons))
        sys.exit(0)

    print("VULNERABLE - SG350/SG350X on affected firmware with SNMP enabled and >=2 60W PoE ports, no mitigation detected; " + ", ".join(reasons))
    sys.exit(1)


if __name__ == "__main__":
    main()