Unit 11: Hardening network devices · Lesson 3 of 4 · 20 min

Case file: the peer nobody added

Compare the SD-WAN manager's control connections with the expected peers, and read a software downgrade that hid a root exploit.

case file

Cisco Catalyst SD-WAN Zero-Day

Cisco Catalyst SD-WAN customers · 2026

In February 2026 Cisco disclosed CVE-2026-20127, a CVSS 10 authentication bypass in Catalyst SD-WAN Controller and Manager caused by a faulty peering authentication mechanism, reported by the Australian Cyber Security Centre. Cisco Talos found a sophisticated actor (UAT-8616) had exploited it since at least 2023, adding rogue peers and likely gaining root by downgrading software to exploit an older flaw (CVE-2022-20775) and then restoring the version. CISA issued Emergency Directive 26-03 on February 25, 2026, requiring inventory, external log storage, forensic collection, patching and threat hunting.

What went wrong

A flaw in how SD-WAN control components authenticated peers, combined with management planes reachable by attackers and logs that could be truncated on the device.

What would have stopped it

  • Restrict SD-WAN control and management interfaces to trusted networks and follow the vendor hardening guide.
  • Send device logs to external storage so on-box tampering cannot erase evidence.
  • Patch promptly and block unauthorized software downgrades.
  • Keep an authoritative inventory of expected SD-WAN peers and their addresses.

What defenders could have seen

  • Unexpected control-connection peering events or peers added/dropped without a change record.
  • Root logins or unknown SSH keys on SD-WAN components (for example the vmanage-admin account).
  • Software downgrade followed by reboot, or missing/truncated logs and shell histories.

sourcesblog.talosintelligence.comhelpnetsecurity.comexecutivegov.com

mission

You are
The analyst running the hunt required by an emergency directive.
Situation
The SD-WAN manager's control events and software history are in ~/devices/sdwan. The expected peers are listed in peers-expected.txt. This lab is modelled on the 2026 Cisco Catalyst SD-WAN case.
Goal
Find any peer that should not exist and any unapproved software change.
Hand in
The rogue peer, its time window and the downgrade sequence.

A flight recorder

01

Read the expected peers

An authoritative list of peers is the baseline for control plane monitoring.

analyst@net-lab
cat sdwan/peers-expected.txt
1.1.1.10 vbond-1
1.1.1.20 vsmart-1
1.1.1.21 vsmart-2
1.1.2.1 edge-london
1.1.2.2 edge-rotterdam
1.1.2.3 edge-singapore
02

Count peers seen in the events

Every system IP in the log should be on the list.

analyst@net-lab
grep -o 'peer-system-ip=[0-9.]*' sdwan/control-events.log | sort | uniq -c
      4 peer-system-ip=1.1.1.20
      6 peer-system-ip=1.1.1.21
      5 peer-system-ip=1.1.2.1
      9 peer-system-ip=1.1.2.2
      4 peer-system-ip=1.1.2.3
      2 peer-system-ip=1.1.9.99

you should see 1.1.9.99 is not an expected peer.

03

Read its events

Note the peer type and how long it stayed.

analyst@net-lab
grep 1.1.9.99 sdwan/control-events.log
2026-10-06T03:12:09Z sdwan-mgr control-connection-state-change peer-system-ip=1.1.9.99 peer-type=vmanage new-state=up
2026-10-06T03:40:51Z sdwan-mgr control-connection-state-change peer-system-ip=1.1.9.99 peer-type=vmanage new-state=down

you should see A peer claiming to be a manager joined at 03:12 and left at 03:40.

04

Read the software history

Approved changes carry a change number. A downgrade to an older release, then an upgrade back, can be used to reach an old flaw and hide it.

analyst@net-lab
cat sdwan/software.log
2026-06-02T22:00:14Z sdwan-mgr software install version=20.12.4 change=CHG-2211
2026-10-06T03:21:33Z sdwan-mgr software activate version=20.9.1 change=none
2026-10-06T03:24:02Z sdwan-mgr system reboot reason=software-activate
2026-10-06T03:37:48Z sdwan-mgr software activate version=20.12.4 change=none
2026-10-06T03:39:55Z sdwan-mgr system reboot reason=software-activate

you should see Two unapproved activations inside the rogue peer's window: down to 20.9.1, then back to 20.12.4.

defender tip Block software downgrades where the platform allows it, and alert on any activation without a change number.

What a defender takes away

  1. 1Keep an authoritative list of expected peers and alert on new ones.
  2. 2Software downgrades are suspicious unless approved.
  3. 3Store device logs externally; on-box logs can be truncated.

Questions

0 of 3 solved

Answer each one from what you find on your lab machine.