A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager

#!/usr/bin/env bash
# check_cve_2026_20224.sh
# Determine likely exposure to CVE-2026-20224 on Cisco Catalyst SD-WAN Manager
# Outputs one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

get_version() {
  local out ver

  # Preferred: official CLI command from Cisco docs
  out="$(request nms application-server version 2>/dev/null)"
  ver="$(printf '%s\n' "$out" | sed -nE 's/.*version ([0-9]+(\.[0-9]+){1,3}).*/\1/p' | tail -n1)"
  if [[ -n "$ver" ]]; then
    printf '%s\n' "$ver"
    return 0
  fi

  # Fallback: scrape show version if available
  out="$(show version 2>/dev/null)"
  ver="$(printf '%s\n' "$out" | grep -Eo '([0-9]+\.){2,3}[0-9]+' | head -n1)"
  if [[ -n "$ver" ]]; then
    printf '%s\n' "$ver"
    return 0
  fi

  return 1
}

parse_ver() {
  local v="$1"
  local a b c d
  IFS='.' read -r a b c d <<< "$v"
  a="${a:-0}"
  b="${b:-0}"
  c="${c:-0}"
  d="${d:-0}"
  printf '%s %s %s %s\n' "$a" "$b" "$c" "$d"
}

main() {
  local ver
  if ! ver="$(get_version)"; then
    echo "UNKNOWN - could not determine SD-WAN Manager version via 'request nms application-server version' or 'show version'"
    exit 2
  fi

  read -r major minor patch build <<< "$(parse_ver "$ver")"

  # Basic sanity check
  if ! [[ "$major" =~ ^[0-9]+$ && "$minor" =~ ^[0-9]+$ && "$patch" =~ ^[0-9]+$ && "$build" =~ ^[0-9]+$ ]]; then
    echo "UNKNOWN - unrecognized version format: $ver"
    exit 2
  fi

  # Cisco fixed matrix from advisory cisco-sa-sdwan-mltvnps2-JxpWm7R
  # Earlier than 20.9 -> vulnerable (must migrate)
  if (( major < 20 )) || { (( major == 20 )) && (( minor < 9 )); }; then
    echo "VULNERABLE - version $ver is earlier than 20.9 and must migrate to a fixed release"
    exit 1
  fi

  # 20.9 -> fixed at 20.9.9.1
  if (( major == 20 && minor == 9 )); then
    if (( patch < 9 )) || { (( patch == 9 )) && (( build < 1 )); }; then
      echo "VULNERABLE - version $ver is below fixed release 20.9.9.1"
      exit 1
    else
      echo "PATCHED - version $ver meets/exceeds 20.9.9.1"
      exit 0
    fi
  fi

  # 20.10 and 20.11 -> vulnerable, migrate to 20.12.7.1
  if (( major == 20 && minor == 10 )); then
    echo "VULNERABLE - 20.10 train is affected; upgrade to a fixed release (Cisco points to 20.12.7.1)"
    exit 1
  fi
  if (( major == 20 && minor == 11 )); then
    echo "VULNERABLE - 20.11 train is affected; upgrade to a fixed release (Cisco points to 20.12.7.1)"
    exit 1
  fi

  # 20.12 -> fixed at 20.12.5.4 / 20.12.6.2 / 20.12.7.1
  if (( major == 20 && minor == 12 )); then
    if (( patch < 5 )); then
      echo "VULNERABLE - version $ver is below fixed 20.12.5.4"
      exit 1
    elif (( patch == 5 && build < 4 )); then
      echo "VULNERABLE - version $ver is below fixed 20.12.5.4"
      exit 1
    elif (( patch == 6 && build < 2 )); then
      echo "VULNERABLE - version $ver is below fixed 20.12.6.2"
      exit 1
    elif (( patch == 7 && build < 1 )); then
      echo "VULNERABLE - version $ver is below fixed 20.12.7.1"
      exit 1
    else
      echo "PATCHED - version $ver is on a fixed 20.12 release"
      exit 0
    fi
  fi

  # 20.13 and 20.14 -> vulnerable, migrate to 20.15.5.2
  if (( major == 20 && minor == 13 )); then
    echo "VULNERABLE - 20.13 train is affected; upgrade to a fixed release (Cisco points to 20.15.5.2)"
    exit 1
  fi
  if (( major == 20 && minor == 14 )); then
    echo "VULNERABLE - 20.14 train is affected; upgrade to a fixed release (Cisco points to 20.15.5.2)"
    exit 1
  fi

  # 20.15 -> fixed at 20.15.4.4 / 20.15.5.2
  if (( major == 20 && minor == 15 )); then
    if (( patch < 4 )); then
      echo "VULNERABLE - version $ver is below fixed 20.15.4.4"
      exit 1
    elif (( patch == 4 && build < 4 )); then
      echo "VULNERABLE - version $ver is below fixed 20.15.4.4"
      exit 1
    elif (( patch == 5 && build < 2 )); then
      echo "VULNERABLE - version $ver is below fixed 20.15.5.2"
      exit 1
    else
      echo "PATCHED - version $ver is on a fixed 20.15 release"
      exit 0
    fi
  fi

  # 20.16 -> vulnerable, migrate to 20.18.2.2
  if (( major == 20 && minor == 16 )); then
    echo "VULNERABLE - 20.16 train is affected; upgrade to a fixed release (Cisco points to 20.18.2.2)"
    exit 1
  fi

  # 20.18 -> fixed at 20.18.2.2
  if (( major == 20 && minor == 18 )); then
    if (( patch < 2 )) || { (( patch == 2 )) && (( build < 2 )); }; then
      echo "VULNERABLE - version $ver is below fixed 20.18.2.2"
      exit 1
    else
      echo "PATCHED - version $ver meets/exceeds 20.18.2.2"
      exit 0
    fi
  fi

  # 26.1 -> fixed at 26.1.1.1
  if (( major == 26 && minor == 1 )); then
    if (( patch < 1 )) || { (( patch == 1 )) && (( build < 1 )); }; then
      echo "VULNERABLE - version $ver is below fixed 26.1.1.1"
      exit 1
    else
      echo "PATCHED - version $ver meets/exceeds 26.1.1.1"
      exit 0
    fi
  fi

  echo "UNKNOWN - version $ver is outside the advisory matrix encoded in this script; verify manually against Cisco's fixed-release table"
  exit 2
}

main "$@"