Top Highlights
- An unknown threat actor exploited a zero-day vulnerability in Cisco Catalyst SD-WAN (CVE-2026-20245) to escalate privileges and create a rogue admin account, with at least two months of prior undetected activity.
- The attacker used malicious CSV file uploads to escalate privileges and maintained cover tracks by deleting files, reversing configuration changes, and employing anti-forensic techniques.
- The campaign involved exploiting previously undisclosed authentication bypass flaws, stealing certificates, and changing default admin credentials to maintain persistent, covert access to critical network infrastructure.
The Threat, Attack Techniques, and Targets
A threat actor exploited a high-severity vulnerability in Cisco Catalyst SD-WAN, known as CVE-2026-20245. This was a zero-day attack, meaning the vulnerability was not known to the vendor or public before its use. The attacker used this flaw to gain root access on the affected device. They needed to be an authenticated user with admin privileges to carry out the attack. The attacker then uploaded a malicious CSV file called “evil_tenant.csv”. This file allowed the attacker to escalate their privileges and create a hidden “troot” user account with full control of the device. They modified and then deleted files to hide their activities. The target was an unspecified communications service provider. The attack happened in two waves, with the second wave possibly using stolen certificates to access the system. The attacker also changed default admin passwords to cover their tracks.
Impact, Security Implications, and Remediation Guidance
The exploit gave the attacker full root-level access to the device. They could control the network, exfiltrate data, and hide their traces. This kind of access can lead to long-term control of the affected network. It shows that vulnerabilities in network devices are serious threats. These devices often lack detection tools like endpoint detection and response (EDR). Attackers may exploit them to gather internal traffic information or keep a foothold in the network. To reduce risk, organizations should consult the vendor or relevant authorities for guidance on fixing this issue. Immediate action includes applying patches if available, changing default passwords, and monitoring for unusual activity.
Expand Your Tech Knowledge
Explore the future of technology with our detailed insights on Artificial Intelligence.
Stay inspired by the vast knowledge available on Wikipedia.
ThreatIntel-V1
