Cisco Catalyst SD-WAN Manager Unauthenticated XML External Entity Injection

#!/usr/bin/env bash
# check_cve_2026_20224.sh
# Checks whether Cisco Catalyst SD-WAN Manager is vulnerable to CVE-2026-20224
# (XXE Injection - arbitrary file read)
# Run on the vManage host via SSH as admin or root.
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

get_version() {
  # Try vManage CLI first
  if command -v vmanage &>/dev/null; then
    vmanage show version 2>/dev/null | grep -oP '[0-9]+\.[0-9]+\.[0-9.]+' | head -1 && return
  fi
  # Fallback: parse /etc/os-release or build info
  if [ -f /etc/viptela-version ]; then
    cat /etc/viptela-version | grep -oP '[0-9]+\.[0-9]+\.[0-9.]+' | head -1 && return
  fi
  # Fallback: show system status via viptela CLI
  if command -v show &>/dev/null; then
    show system status 2>/dev/null | grep -i 'version' | grep -oP '[0-9]+\.[0-9]+\.[0-9.]+' | head -1 && return
  fi
  echo ""
}

version_gte() {
  # Returns 0 if $1 >= $2 using sort -V
  [ "$(printf '%s\n%s' "$1" "$2" | sort -V | head -1)" = "$2" ]
}

VERSION=$(get_version)

if [ -z "$VERSION" ]; then
  echo "UNKNOWN - Could not determine vManage version."
  echo "Manually verify with: show system status | grep version"
  exit 2
fi

echo "Detected vManage version: $VERSION"

# Fixed versions per release train:
# 20.9.x  -> 20.9.9.1
# 20.12.x -> 20.12.5.4 (earliest fix in train)
# 20.15.x -> 20.15.4.4
# 20.18.x -> 20.18.2.2
# 26.x    -> 26.1.1.1

MAJOR_MINOR=$(echo "$VERSION" | grep -oP '^[0-9]+\.[0-9]+')

case "$MAJOR_MINOR" in
  20.9)
    if version_gte "$VERSION" "20.9.9.1"; then
      echo "PATCHED - Version $VERSION >= 20.9.9.1"
      exit 0
    fi
    ;;
  20.10|20.11)
    echo "VULNERABLE - Release train $MAJOR_MINOR has no fix; migrate to a supported train."
    exit 1
    ;;
  20.12)
    if version_gte "$VERSION" "20.12.5.4"; then
      echo "PATCHED - Version $VERSION >= 20.12.5.4"
      exit 0
    fi
    ;;
  20.13|20.14)
    echo "VULNERABLE - Release train $MAJOR_MINOR has no fix; migrate to a supported train."
    exit 1
    ;;
  20.15)
    if version_gte "$VERSION" "20.15.4.4"; then
      echo "PATCHED - Version $VERSION >= 20.15.4.4"
      exit 0
    fi
    ;;
  20.16|20.17)
    echo "VULNERABLE - Release train $MAJOR_MINOR has no fix; migrate to a supported train."
    exit 1
    ;;
  20.18)
    if version_gte "$VERSION" "20.18.2.2"; then
      echo "PATCHED - Version $VERSION >= 20.18.2.2"
      exit 0
    fi
    ;;
  26.1)
    if version_gte "$VERSION" "26.1.1.1"; then
      echo "PATCHED - Version $VERSION >= 26.1.1.1"
      exit 0
    fi
    ;;
  26.*)
    if version_gte "$VERSION" "26.1.1.1"; then
      echo "PATCHED - Version $VERSION >= 26.1.1.1"
      exit 0
    fi
    ;;
  *)
    if version_gte "$VERSION" "26.1.1.1"; then
      echo "PATCHED - Version $VERSION is at or above the latest fix."
      exit 0
    fi
    echo "VULNERABLE - Version $VERSION (train $MAJOR_MINOR) is in the affected range."
    exit 1
    ;;
esac

echo "VULNERABLE - Version $VERSION is below the fixed release for the $MAJOR_MINOR train."
exit 1