Cisco Secure Firewall Management Center Authentication Bypass to Root Code Execution

Repository is a standalone Python PoC for CVE-2026-20079 against Cisco Secure Firewall Management Center, not tied to a major exploit framework. The main exploit file is CVE-2026-20079.py; supporting documentation is in README.md and BLOG.md, and tests/test_poc.py provides a local mock FMC server and unit/integration-style tests. Core exploit chain implemented in the Python script matches the publicly documented sequence: reuse static session cookie 'csm_processes', POST to /login.cgi?logon=Continue with hardcoded machine credentials 'report'/'snortrules', GET /ui/user/general to scrape a 32-hex sf_action_id, POST to /sajaxintf.cgi?rs=callServerFunc to abuse validateLicense and write controlled content to /var/tmp/license.tmp, then POST to /pjb.cgi to invoke upgradeReadinessCall and execute the payload as root. Capabilities are broader than simple detection. The tool supports: fingerprint mode for likely FMC identification; check mode for auth-bypass validation; proof mode for root-execution verification via callback markers and collected identity/build output; and exploit mode for an interactive reverse shell using mkfifo, /bin/sh, and netcat. It also includes listener support, callback verification, cleanup tracking, target normalization, CIDR-based fingerprint input handling, and proxy/TLS options. The repository appears legitimate and operational: it contains substantial exploit logic, argument parsing, network handling, callback verification, and automated tests simulating the vulnerable endpoints. It is not merely a README or scanner. The exploit is operational rather than weaponized because it includes working payload delivery and callback handling, but remains a standalone PoC with explicit operator-supplied parameters rather than a reusable framework module.

This repository is a small standalone exploit PoC consisting of one Python script and one README. The main file, CVE-2026-20079.py, is the only code artifact and serves as the entry point. It uses the requests library to interact with a Cisco Secure Firewall Management Center (FMC) web interface over HTTPS, explicitly disabling certificate verification to accommodate self-signed deployments. The exploit logic is a two-stage chain. First, it creates a requests session and sends a POST request to /api/fmc_config/v1/upgradeSession with parameters action=session_upgrade and partial_session=1, attempting to abuse an alleged boot-time partial session condition to bypass authentication. If the response status indicates success (200/204/302), the script treats the target as compromised at the session level. Second, if the operator supplied a command, it sends another POST request to /cgi-bin/privilegedScriptHandler.cgi with script=exec, cmd=<command>, and elevate=root, attempting to execute arbitrary commands as root. The script also includes a --shell mode, but this does not automatically establish a shell; it only prints a suggested bash reverse-shell one-liner using /dev/tcp/YOUR_IP/4444. Capabilities: unauthenticated remote authentication bypass, session hijacking, arbitrary root command execution, and operator-guided reverse-shell follow-on. Attack surface: network/web against the FMC management interface. There is no persistence, lateral movement, or post-exploitation automation beyond command execution. Repository structure is minimal and purpose-built: README.md documents the claimed vulnerability, affected versions, impact, and references, while the Python script operationalizes the exploit chain. This is not part of a larger exploit framework such as Metasploit or Nuclei. Based on the code, it is an operational PoC rather than a detection script: it actively sends exploit requests and can execute attacker-provided commands. The payload is basic and hardcoded around two HTTP POST requests, so maturity is best classified as OPERATIONAL rather than weaponized.