DEV Community

threataft
threataft

Posted on Originally published at youtube.com

Cisco SD-WAN CVE-2026-20127 — A CVSS 10.0 Auth Bypass, a Key-Stealing Implant, and a Relay Network Built to Disappear

#security #cisco #networking #vulnerabilities

Cisco Catalyst SD-WAN controllers carry a CVSS 10.0 authentication bypass (CVE-2026-20127) that was exploited before disclosure — and continued after. Attackers used it to install KeyDrift, a two-component implant that hooks into the controller's key-management process and extracts AES-256 traffic keys after decryption.

The second finding came from Lumen's Black Lotus Labs: Silent Train, Volt Typhoon's relay network of compromised SOHO routers and IoT devices, rotated per session and cleaned up afterward. Cisco Talos assesses with high confidence that the infrastructure behind KeyDrift overlaps considerably with Silent Train.

What KeyDrift Does

KeyDrift doesn't break AES-256. It sits inside vdaemon — the legitimate process that handles SD-WAN's encrypted control sessions — and reads the keys after the controller decrypts them.

  • LittleFilch hooks SSL_read, extracts 32-byte AES-256 keying material for a predefined list of edge nodes, RSA-encrypts it, and stages it for UDP exfiltration
  • PolyFlame is the backdoor — memory-resident, no hardcoded C2 address, accepts commands hidden inside SD-WAN control traffic

Persistence is via modified runit service scripts. On Validators, a fake compiled aaamgrd service (Cisco's real one is a Python package) loads PolyFlame into memory.

Two 10.0s, Three Months Apart

CVE Disclosed Actor Fixed
CVE-2026-20127 Feb 25, 2026 UAT-11473 20.9.8.2 / 20.12.5.3 / 20.12.6.1 / 20.15.4.2 / 20.18.2.1
CVE-2026-20182 May 2026 UAT-8616 Same trains

Rapid7 found the second while investigating the first. A fix for one didn't close the class.

What to Hunt

  • Modified runit scripts under /etc/sv/sshd/run
  • Fake aaamgrd service at /etc/sv/aaamgr/ on Validators
  • /tmp/system-vdaemon (loader artifact)
  • Unknown peer IPs in WebUI → Devices → System IP
  • Outbound UDP to addresses not in your configuration
  • NETCONF changes without a change ticket

Patching closes the entry point. It does not remove an implant already running in memory.

The Attribution Call

Talos says: high confidence infrastructure overlap between UAT-11473 and Silent Train. It explicitly does not say the actors are identical. That is the correct level of assertion for relay-network analysis — and it doesn't change the remediation either way.

Full breakdown including detection indicators, version table, and mitigation checklist:
https://threataft.com/articles/cisco-sd-wan-cve-2026-20127-volt-typhoon-silent-train-keydrift

Top comments (0)