Unit 11: Hardening network devices · Lesson 3 of 4 · 20 min

Case file: the peer nobody added

Compare the SD-WAN manager's control connections with the expected peers, and read a software downgrade that hid a root exploit.

case file

Cisco Catalyst SD-WAN Zero-Day

Cisco Catalyst SD-WAN customers · 2026

In February 2026 Cisco disclosed CVE-2026-20127, a CVSS 10 authentication bypass in Catalyst SD-WAN Controller and Manager caused by a faulty peering authentication mechanism, reported by the Australian Cyber Security Centre. Cisco Talos found a sophisticated actor (UAT-8616) had exploited it since at least 2023, adding rogue peers and likely gaining root by downgrading software to exploit an older flaw (CVE-2022-20775) and then restoring the version. CISA issued Emergency Directive 26-03 on February 25, 2026, requiring inventory, external log storage, forensic collection, patching and threat hunting.

What went wrong

A flaw in how SD-WAN control components authenticated peers, combined with management planes reachable by attackers and logs that could be truncated on the device.

What would have stopped it

  • Restrict SD-WAN control and management interfaces to trusted networks and follow the vendor hardening guide.
  • Send device logs to external storage so on-box tampering cannot erase evidence.
  • Patch promptly and block unauthorized software downgrades.
  • Keep an authoritative inventory of expected SD-WAN peers and their addresses.

What defenders could have seen

  • Unexpected control-connection peering events or peers added/dropped without a change record.
  • Root logins or unknown SSH keys on SD-WAN components (for example the vmanage-admin account).
  • Software downgrade followed by reboot, or missing/truncated logs and shell histories.

sourcesblog.talosintelligence.comhelpnetsecurity.comexecutivegov.com

mission

You are
The analyst running the hunt required by an emergency directive.
Situation
The SD-WAN manager's control events and software history are in ~/devices/sdwan. The expected peers are listed in peers-expected.txt. This lab is modelled on the 2026 Cisco Catalyst SD-WAN case.
Goal
Find any peer that should not exist and any unapproved software change.
Hand in
The rogue peer, its time window and the downgrade sequence.

A flight recorder

01

Read the expected peers

An authoritative list of peers is the baseline for control plane monitoring.

analyst@net-lab
cat sdwan/peers-expected.txt
1.1.1.10 vbond-1
1.1.1.20 vsmart-1
1.1.1.21 vsmart-2
1.1.2.1 edge-london
1.1.2.2 edge-rotterdam
1.1.2.3 edge-singapore
cat
Prints the contents of one or more files. Built into Linux and macOS.
02

Count peers seen in the events

Every system IP in the log should be on the list.

analyst@net-lab
grep -o 'peer-system-ip=[0-9.]*' sdwan/control-events.log | sort | uniq -c
      4 peer-system-ip=1.1.1.20
      6 peer-system-ip=1.1.1.21
      5 peer-system-ip=1.1.2.1
      9 peer-system-ip=1.1.2.2
      4 peer-system-ip=1.1.2.3
      2 peer-system-ip=1.1.9.99

you should see 1.1.9.99 is not an expected peer.

grep
Prints the lines of text that match a pattern. Built into Linux and macOS.
sort
Sorts lines of text. Built into Linux and macOS.
uniq
Collapses repeated neighbouring lines. With -c it counts them. Built into Linux and macOS.
03

Read its events

Note the peer type and how long it stayed.

analyst@net-lab
grep 1.1.9.99 sdwan/control-events.log
2026-10-06T03:12:09Z sdwan-mgr control-connection-state-change peer-system-ip=1.1.9.99 peer-type=vmanage new-state=up
2026-10-06T03:40:51Z sdwan-mgr control-connection-state-change peer-system-ip=1.1.9.99 peer-type=vmanage new-state=down

you should see A peer claiming to be a manager joined at 03:12 and left at 03:40.

04

Read the software history

Approved changes carry a change number. A downgrade to an older release, then an upgrade back, can be used to reach an old flaw and hide it.

analyst@net-lab
cat sdwan/software.log
2026-06-02T22:00:14Z sdwan-mgr software install version=20.12.4 change=CHG-2211
2026-10-06T03:21:33Z sdwan-mgr software activate version=20.9.1 change=none
2026-10-06T03:24:02Z sdwan-mgr system reboot reason=software-activate
2026-10-06T03:37:48Z sdwan-mgr software activate version=20.12.4 change=none
2026-10-06T03:39:55Z sdwan-mgr system reboot reason=software-activate

you should see Two unapproved activations inside the rogue peer's window: down to 20.9.1, then back to 20.12.4.

defender tip Block software downgrades where the platform allows it, and alert on any activation without a change number.

What a defender takes away

  1. 1Keep an authoritative list of expected peers and alert on new ones.
  2. 2Software downgrades are suspicious unless approved.
  3. 3Store device logs externally; on-box logs can be truncated.

Questions

0 of 3 solved

Answer each one from what you find on your lab machine.