CVE-2026-20127

CVE-2026-20127 Overview An exploit for the Cisco Catalyst SD-WAN Controller authentication bypass vulnerability, CVE-2026-20127. This exploit targets the vbondprocchallengeackack handler. It sends a forged CHALLENGEACKACK message msgtype=10 with an attacker-controlled verifystatus=1 byte, directl...

neurax

A framework that aids in creation of self-spreading software Overview With help of Neurax, Golang binaries can spread on LAN/WAN without using any external servers. Diverse config options and command stagers allow rapid propagation across various wireless environments. Example code package main...

sdwan-scanner-CVE-2026-20127

Cisco SD-WAN Exposure Scanner CVE-2026-20127 A specialized passive fingerprinting tool designed to identify internet-facing Cisco SD-WAN vManage / Viptela instances. This tool helps security researchers and system administrators manage their external attack surface by detecting potentially expose...

CVE-2026-20127---Cisco-SD-WAN-Preauth-RCE

CVE-2026-20127---Cisco-SD-WAN-Preauth-RCE Cisco SD-WAN Zero-Day CVE-2026-20127 Exploited Since 2023 for Admin Access. This repository contains a working proof-of-concept exploit for CVE-2026-20127, a critical pre-authentication vulnerability in Cisco Catalyst SD-WAN Controller formerly vSmart and...

CVE-2026-20131-POC

CVE-2026-20131---Cisco-SD-WAN-Preauth-RCE Cisco SD-WAN Zero-Day CVE-2026-20131 Exploited Since 2023 for Admin Access. This repository contains a working proof-of-concept exploit for CVE-2026-20131, a critical pre-authentication vulnerability in Cisco Catalyst SD-WAN Controller formerly vSmart and...

CVE-2018-6961

CVE-2018-6961 Exploit in Python3 VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component. This component is disabled by default and should not be enabled on untrusted networks. VeloCloud by VMware will be removing this...

CVE-2021-24006

CVE-2021-24006 – FortiManager Improper Access Control Exploit PoC PoC Proof of Concept - Educational Use Only Exploit for improper access to SD-WAN Orchestrator in FortiManager, exploiting an access control flaw CWE-284. Description The vulnerability CVE-2021-24006 affects FortiManager versions...

CVE-2026-20127-Cisco-SD-WAN-Preauth-RCE

CVE-2026-20127-Cisco SD-WAN Pre-Authentication Remote Code Execution Overview This repository contains a proof-of-concept PoC exploit for CVE-2026-20127 , a critical pre-authentication remote code execution RCE vulnerability affecting Cisco Catalyst SD-WAN Controller formerly vSmart and Cisco...

CVE-2021-24006-Fortimanager-Exploit

CVE-2021-24006 – FortiManager Improper Access Control Exploit PoC PoC Proof of Concept - Educational Use Only Exploit for improper access to SD-WAN Orchestrator in FortiManager, exploiting access control flaw CWE-284. Description The CVE-2021-24006 vulnerability affects FortiManager versions 6.4....

Netgear_Pwn2Own2021

Netgear R6700v3 WAN RCE - Pwn2Own 2021 This is the code used during Pwn2Own 2021 to get a remote shell on the Netgear R6700v3. Blogpost: https://synacktiv.com/publications/pwn2own-austin-2021-defeating-the-netgear-r6700v3 Requirements python3 with flask dnsmasq Usage 1. Run as root ./play.sh ifna...

cve-2026-20127

CVE-2026-20127 Scanner Overview This project is a Windows-based network scanning tool written in C++ that attempts to identify potential Cisco SD-WAN / vManage-like services and perform a vulnerability check against a referenced issue labeled CVE-2026-20127. Features IP range scanning start → end...

CVE-2026-20127-Exploit-Extension

Executive Summary The CVE-2026-20127 Defensive Companion is a premier, enterprise-grade Browser Extension engineered for proactive threat intelligence and defensive analysis. This tool encapsulates authoritative technical research concerning the authentication bypass vulnerability in the Cisco...

CVE-2026-75616

CVE-2026-75616 Authenticated OS command injection in the TP-Link Archer C20 v6 web management interface. BPA WAN configuration values are passed to system without adequate neutralization, allowing an authenticated administrator on the adjacent network to execute commands as root. Discovered and...

sdwan-harvester

SD-WAN Harvester 🌐 SD-WAN Internet Census Framework Disclaimer This project is no longer maintained. It is stable and you still can use it for SD-WAN scanning, but currently, more preferable and accurate way to scan different things on the internet not only SD-WAN solutions is to use our new...

CVE-2025-54322

CVE-2025-54322 - XSpeeder SXZOS Pre-Auth RCE Scanner A multi-threaded vulnerability scanner for CVE-2025-54322, an unauthenticated remote code execution vulnerability in XSpeeder SXZOS firmware affecting 70,000+ hosts globally. 📋 Table of Contents About the Vulnerability Features Installation Usa...

netgear-pwnagent

PwnAgent This is the PoC for CVE-2023-24749, aka PwnAgent, a One-Click WAN-side RCE in Netgear RAX Routers. You can trigget this exploit by visiting http://pwn.mahaloz.re. Explanation Please visit the blog which explains this here...

CVE-2022-39073

CVE-2022-39073 Firmware details: wainnerversion: BDPOSTEMF286RMODULEV1.0.0B12 crversion: CRITPOSTEMF286RV1.0.0B10 Prerequisites requests pip install requests Command Injection The vulnerability is a shared command injection between the ztenetlinkdetect binary and the WATCHDOGSWITCH handler in the...

CVE-2026-76504-Proof-of-concept

Cisco Catalyst SD-WAN Manager — CVE-2026-76504 Unauthenticated authentication bypass caused by improper handling of URL encoding CWE-177 in the API session management layer. A crafted request reaches a privileged endpoint and is treated as an authenticated admin session. Overview The vulnerabilit...

CVE-2026-20127_EXP

CVE-2026-20127EXP Cisco Catalyst SD-WAN Authentication Bypass Vulnerability CVE-2026-20127 Exploit EXP Basic Usage python scan.py -f targets.txt Display Detailed Information python scan.py -f targets.txt -v Adjust Thread Count and Save Results python scan.py -f targets.txt -t 10 -o vulnerable.txt...

CVE-2026-20127

CVE-2026-20127 — Authentication Bypass in Cisco SD-WAN CVSS 10.0 Table of Contents | Section| What's In It ---|---|--- 01| SD-WAN Crash Course| The basics I needed to learn before any of this made sense — architecture, NETCONF, and how peering auth works 02| The Bouncer Problem| Where the auth co...