CVE-2026-20079 PoC

Read the companion write-up, From Advisory to Root: Reproducing CVE-2026-20079 on Cisco Secure FMC, for the reproduction path, failed payloads, and evidence behind this PoC.

What it does

This PoC implements the request sequence publicly documented for CVE-2026-20079 in Cisco Secure Firewall Management Center. It separates product fingerprinting, authentication-bypass checking, one-shot root proof, and interactive exploitation so the operator can choose the smallest mode needed.

Why it exists

The manual chain is easy to misread: successful HTTP responses do not prove code execution, callback behavior depends on the appliance environment, and stronger confirmation changes server-side session state. I wrote the tool to make those distinctions visible and keep request construction, proof, and cleanup consistent.

Modes

• --fingerprint sends bounded GET requests and identifies a possible FMC surface without testing the CVE.
• --check compares at most two GET responses without upgrading the session, writing a file, or executing a command.
• --check --intrusive upgrades the boot-created session and confirms access to a valid, nonzero action token. It changes server-side session state.
• --proof uses a bounded callback to verify root execution and cleanup without providing an interactive shell.
• --exploit runs the public write-and-trigger chain, with optional bounded automatic verification.

Fingerprint MATCH requires both the Cisco icon path and the structured deviceLabel value for Management Center. The generic product name alone is not treated as a product match. The JSON serializer converts actual script newlines to the required Unicode escapes without changing literal backslash sequences in command content.

The additional GET-only comparison is adapted from the ProjectDiscovery Nuclei template authored by theamanrawat. It complements the original FMC fingerprint and the stronger state-changing check.

Evidence standard

The GET-only check reports APPEARS only when the request without a session cookie is rejected and the request with csm_processes returns HTTP 200 with the complete expected FMC about-page markers. PARTIAL-MATCH means only part of that known response pattern matched; it does not confirm the CVE. UNCONFIRMED also does not establish that the appliance is patched because the required boot-created session is transient.

The intrusive check confirms the bypass only when the upgraded session exposes a valid, nonzero sf_action_id. An HTTP 302 or 200 is not treated as root proof. Automatic proof succeeds only when the callback returns uid=0(root) and the temporary artifacts are confirmed absent. The request chain was also reproduced manually. Local tests cover request construction, callback handling, and failure paths.

Limitations

• An affected version may not be exploitable if the required boot-created session no longer exists.
• The default GET-only check accesses a protected endpoint but does not upgrade the session. The intrusive check, proof, and exploit modes modify target state; temporary-file cleanup does not restore the upgraded server-side session.
• Callback modes depend on target-side shell utilities and a working return route.
• The tool does not automate credential collection, persistence, or lateral movement.