Cisco Catalyst SD-WAN Manager/Controller/Validator CLI Command Injection Privilege Escalation

#!/bin/bash
# check_cve_2026_20245.sh
# Checks whether CVE-2026-20245 is patched on Cisco Catalyst SD-WAN Manager/Controller/Validator
# Run on the target appliance via SSH. Requires admin-level access.
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Also checks for IOCs from the Mandiant campaign.

set -euo pipefail

VERSION=$(cat /etc/viptela/confd_version 2>/dev/null || echo "")

if [ -z "$VERSION" ]; then
    echo "UNKNOWN - Could not determine SD-WAN software version. Is this a Catalyst SD-WAN appliance?"
    exit 2
fi

echo "Detected SD-WAN version: $VERSION"

# Compare version against known fixed versions
# Fixed: 20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1, 26.1.1.2
version_gte() {
    printf '%s\n%s' "$1" "$2" | sort -V | head -n1 | grep -qx "$2"
}

PATCHED=0

case "$VERSION" in
    20.9.*)
        version_gte "$VERSION" "20.9.9.2" && PATCHED=1
        ;;
    20.12.*)
        version_gte "$VERSION" "20.12.7.2" && PATCHED=1
        ;;
    20.15.4.*)
        version_gte "$VERSION" "20.15.4.5" && PATCHED=1
        ;;
    20.15.5.*|20.15.[6-9].*|20.1[6-7].*)
        version_gte "$VERSION" "20.15.5.3" && PATCHED=1
        ;;
    20.18.*)
        version_gte "$VERSION" "20.18.3.1" && PATCHED=1
        ;;
    26.*)
        version_gte "$VERSION" "26.1.1.2" && PATCHED=1
        ;;
    *)
        echo "UNKNOWN - Version $VERSION not in known affected release trains."
        exit 2
        ;;
esac

# IOC checks regardless of patch status
echo "--- IOC Checks ---"
IOC_FOUND=0
if grep -q '^troot:' /etc/passwd 2>/dev/null; then
    echo "[!] ALERT: Backdoor user 'troot' found in /etc/passwd. Investigate immediately."
    IOC_FOUND=1
fi
if [ -f /home/admin/evil_tenant.csv ]; then
    echo "[!] ALERT: evil_tenant.csv found. Known exploit artifact."
    IOC_FOUND=1
fi
if [ -f /home/admin/.orig_passwd ]; then
    echo "[!] ALERT: .orig_passwd backup found. Known anti-forensic artifact."
    IOC_FOUND=1
fi
if [ -f /home/admin/.orig_shadow ]; then
    echo "[!] ALERT: .orig_shadow backup found. Known anti-forensic artifact."
    IOC_FOUND=1
fi
if [ -f /home/admin/.orig_vbond_vsmart_tenant_list ]; then
    echo "[!] ALERT: .orig_vbond_vsmart_tenant_list backup found. Known anti-forensic artifact."
    IOC_FOUND=1
fi
if grep -q 'upload_tenant_list' /var/log/scripts.log 2>/dev/null; then
    echo "[*] INFO: tenant-list upload activity found in scripts.log. Review manually."
fi
# Check for any UID 0 accounts besides root
UID0_ACCOUNTS=$(awk -F: '$3 == 0 && $1 != "root" {print $1}' /etc/passwd 2>/dev/null)
if [ -n "$UID0_ACCOUNTS" ]; then
    echo "[!] ALERT: Non-root UID 0 account(s) found: $UID0_ACCOUNTS"
    IOC_FOUND=1
fi
if [ "$IOC_FOUND" -eq 1 ]; then
    echo "[!!!] IOCs DETECTED - This system may have been compromised. Preserve evidence with 'request admin-tech' and engage IR."
fi
echo "--- End IOC Checks ---"

if [ "$PATCHED" -eq 1 ]; then
    echo "PATCHED - Version $VERSION is at or above the fix for CVE-2026-20245."
    exit 0
else
    echo "VULNERABLE - Version $VERSION is affected by CVE-2026-20245. Upgrade immediately."
    exit 1
fi