Mandiant reveals how Cisco SD-WAN zero-day attacks gained root access
Mandiant has revealed how hackers exploited a Cisco Catalyst SD-WAN vulnerability to create rogue root accounts on targeted devices. The vulnerability, tracked as CVE-2026-20245, is a high-severity command injection flaw that allows authenticated attackers to execute arbi…
Intelligence analysis by Llama 3.3 70B
The attackers exploited the vulnerability by uploading a crafted file to the affected system, creating a new account with root-level privileges and using anti-forensic tactics to evade detection.
Hackers found a way to get special access to some computer systems by exploiting a flaw in the software. They used this access to create a new account with high-level privileges, making it hard to detect their activities.
Analysis
Introduction to SD-WAN Vulnerabilities
The Cisco Catalyst SD-WAN vulnerability, tracked as CVE-2026-20245, is a high-severity command injection flaw that allows authenticated attackers to execute arbitrary commands as root. This vulnerability is particularly concerning because it can be exploited by attackers who have already gained access to targeted SD-WAN devices.
Exploitation of the Vulnerability
The exploitation of the vulnerability began with unauthorized SD-WAN peering connections observed on a service provider's infrastructure. The attackers established new rogue peer connections and authenticated to affected SD-WAN Manager devices using the vmanage-admin account. After gaining access, the attackers changed the default admin account password, logged in to the SD-WAN Manager web interface, and extracted configuration information for edge devices, controllers, and SD-WAN templates.
Anti-Forensic Tactics
The attackers heavily relied on anti-forensic tactics to evade detection. This includes backing up configuration files before modifying them and then restoring them after exploitation. They also cleaned up traces of exploitation by deleting the malicious CSV payload, removing temporary files created during the attack, and erasing evidence of the rogue root account. The researchers also observed the execution of a validation script to confirm that all traces of the compromise had been removed from the device.
Recommendations for Organizations
Mandiant has published indicators of compromise, attacker IP addresses, and guidance to help organizations determine whether they were compromised. Organizations should collect diagnostic data from SD-WAN devices, check for signs of unauthorized peering connections, and upgrade to the latest software releases if they have not already done so. It is essential for organizations to prioritize software updates and use secure authentication methods to prevent similar attacks in the future.
Key points
- The Cisco Catalyst SD-WAN vulnerability, tracked as CVE-2026-20245, is a high-severity command injection flaw.
- The vulnerability can be exploited by authenticated attackers to execute arbitrary commands as root.
- The attackers used anti-forensic tactics to evade detection.
The revelation of the vulnerability and the subsequent release of security updates by Cisco can help organizations prevent similar attacks in the future. By prioritizing software updates and using secure authentication methods, organizations can reduce the risk of exploitation.
The exploitation of the vulnerability highlights the risks associated with complex software systems and the importance of robust security measures. If left unaddressed, similar vulnerabilities can be exploited by attackers, leading to significant consequences for organizations.
