A vulnerability in Cisco Unified Communications Manager

#!/usr/bin/env python3
# verify_cve_2026_20230.py
# CVE-2026-20230 verifier for Cisco Unified CM / Unified CM SME
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=USAGE/ERROR

import argparse
import re
import sys
import ssl
import urllib.request
import urllib.error

TIMEOUT = 8
PATHS = ["https://{host}:8443/webdialer/", "https://{host}/webdialer/"]


def fetch(url):
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE
    req = urllib.request.Request(url, headers={"User-Agent": "noisgate-cve-2026-20230-check/1.0"})
    try:
        with urllib.request.urlopen(req, timeout=TIMEOUT, context=ctx) as resp:
            body = resp.read(2048).decode("utf-8", errors="ignore")
            return resp.getcode(), body, None
    except urllib.error.HTTPError as e:
        try:
            body = e.read(2048).decode("utf-8", errors="ignore")
        except Exception:
            body = ""
        return e.code, body, None
    except Exception as e:
        return None, "", str(e)


def normalize_version(v):
    return v.strip().upper().replace(" ", "")


def is_patched(version):
    v = normalize_version(version)
    if "COP" in v:
        return True

    m14 = re.match(r"^14(?:SU(\d+))?$", v)
    if m14:
        su = m14.group(1)
        if su is None:
            return False
        return int(su) >= 6

    m15 = re.match(r"^15(?:SU(\d+))?$", v)
    if m15:
        su = m15.group(1)
        if su is None:
            return False
        return int(su) >= 5

    return None


def webdialer_reachable(host):
    observations = []
    for tmpl in PATHS:
        url = tmpl.format(host=host)
        code, body, err = fetch(url)
        observations.append((url, code, err))
        if err is None and code is not None:
            text = (body or "").lower()
            # Any HTTP response on /webdialer/ strongly suggests the service/path is live.
            if code in (200, 401, 403):
                return True, observations
            if "webdialer" in text or "click-to-dial" in text:
                return True, observations
    return False, observations


def main():
    ap = argparse.ArgumentParser(description="Verify likely exposure to CVE-2026-20230")
    ap.add_argument("--host", required=True, help="CUCM hostname or IP")
    ap.add_argument("--version", required=True, help="Example: 14SU5, 14SU6, 15SU4, 15SU5, 15SU4+COP")
    args = ap.parse_args()

    patch_state = is_patched(args.version)
    if patch_state is None:
        print("UNKNOWN")
        print("Reason: Unrecognized version format. Supply versions like 14SU5, 14SU6, 15SU4, 15SU5, or include COP if a Cisco COP patch is installed.")
        sys.exit(2)

    reachable, observations = webdialer_reachable(args.host)

    if patch_state is True:
        print("PATCHED")
        print(f"Reason: Version '{args.version}' meets or exceeds the fixed baseline or indicates a COP patch.")
        sys.exit(0)

    # Unpatched branch below
    if reachable:
        print("VULNERABLE")
        print(f"Reason: Host '{args.host}' appears to expose /webdialer/ and supplied version '{args.version}' is below the fixed release.")
        for url, code, err in observations:
            status = err if err else f"HTTP {code}"
            print(f"Observed: {url} -> {status}")
        sys.exit(1)

    print("UNKNOWN")
    print(f"Reason: Version '{args.version}' is below the fixed baseline, but /webdialer/ was not confirmed reachable from this vantage point.")
    print("Interpretation: This may mean WebDialer is disabled, filtered by ACL/proxy, or the target is unreachable from your workstation.")
    for url, code, err in observations:
        status = err if err else f"HTTP {code}"
        print(f"Observed: {url} -> {status}")
    sys.exit(2)


if __name__ == "__main__":
    try:
        main()
    except KeyboardInterrupt:
        print("UNKNOWN")
        print("Reason: Interrupted by user.")
        sys.exit(2)
    except Exception as e:
        print("UNKNOWN")
        print(f"Reason: Execution error: {e}")
        sys.exit(3)