Cisco Catalyst SD-WAN Manager Improper Output Encoding Exploitation

let sdwan_mgr_ips = dynamic([]);
union DeviceEvents, CommonSecurityLog, Syslog
| where TimeGenerated >= ago(24h)
| where (
    (DeviceVendor == "Cisco" and DeviceProduct has_any ("SD-WAN", "vManage", "Catalyst SD-WAN Manager"))
    or (Computer has_any ("vmanage", "sdwan-manager", "sdwanmgr"))
    or (SourceSystem == "Syslog" and ProcessName has_any ("vmanage", "sdwan"))
)
| where Message has_any (
    "privilege", "escalat", "unauthorized", "injection", "encoding", "escape",
    "admin", "root", "sudo", "permission denied", "access denied", "forbidden",
    "REST API", "/dataservice/", "HTTP/1"
)
| extend SuspiciousIndicators = case(
    Message has_any ("privilege escalat", "unauthorized privilege"), "PrivilegeEscalation",
    Message has_any ("injection", "encoding error", "escape"), "OutputEncodingAbuse",
    Message has_any ("admin", "root") and Message has "failed", "AuthFailureAdminContext",
    "Other"
)
| where SuspiciousIndicators != "Other"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Messages = make_set(Message, 10) by Computer, SuspiciousIndicators, SourceSystem
| where EventCount >= 2
| project-reorder FirstSeen, LastSeen, Computer, SuspiciousIndicators, EventCount, Messages

index=network_security OR index=cisco_sdwan OR index=syslog
(sourcetype="cisco:sdwan" OR sourcetype="cisco:ios" OR sourcetype="syslog" OR sourcetype="cisco:asa")
(host="*vmanage*" OR host="*sdwan*manager*" OR host="*sdwanmgr*" OR vendor="Cisco")
earliest=-24h
| eval suspicious_indicator=case(
    match(lower(_raw), "privilege.escal"), "PrivilegeEscalation",
    match(lower(_raw), "inject|encod.*error|escape.*fail"), "OutputEncodingAbuse",
    match(lower(_raw), "unauthorized.*admin|admin.*unauthorized"), "UnauthorizedAdminAccess",
    match(lower(_raw), "/dataservice/.*403|/dataservice/.*401"), "APIAuthFailure",
    true(), "Other"
)
| where suspicious_indicator!="Other"
| stats count as event_count, earliest(_time) as first_seen, latest(_time) as last_seen, values(_raw) as raw_events by host, suspicious_indicator, sourcetype
| where event_count >= 2
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - event_count
| table first_seen, last_seen, host, sourcetype, suspicious_indicator, event_count, raw_events

sequence by host.name with maxspan=10m
  [network where
    (host.name like~ "*vmanage*" or host.name like~ "*sdwan*" or host.name like~ "*sdwanmgr*")
    and (url.path like~ "*/dataservice/*" or url.path like~ "*/rest/*")
    and http.response.status_code in (401, 403, 500)
  ] with runs=2
  [any where
    (host.name like~ "*vmanage*" or host.name like~ "*sdwan*")
    and (
      message like~ "*privilege*escal*"
      or message like~ "*unauthorized*admin*"
      or message like~ "*encoding*error*"
      or message like~ "*output*escape*"
    )
  ]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  username,
  LOGSOURCENAME(logsourceid) AS log_source,
  category,
  CATEGORYNAME(category) AS category_name,
  "Message" AS event_message
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) ILIKE '%cisco%'
  AND (
    LOWER("Message") ILIKE '%sd-wan%'
    OR LOWER("Message") ILIKE '%vmanage%'
    OR LOWER("Message") ILIKE '%sdwan manager%'
  )
  AND (
    LOWER("Message") ILIKE '%privilege escal%'
    OR LOWER("Message") ILIKE '%unauthorized%admin%'
    OR LOWER("Message") ILIKE '%output encod%'
    OR LOWER("Message") ILIKE '%escape%error%'
    OR LOWER("Message") ILIKE '%injection%'
    OR (LOWER("Message") ILIKE '%403%' AND LOWER("Message") ILIKE '%dataservice%')
    OR (LOWER("Message") ILIKE '%401%' AND LOWER("Message") ILIKE '%dataservice%')
  )
  AND starttime > NOW() - 86400000
ORDER BY starttime DESC
LIMIT 500

(_sourceCategory="cisco/sdwan" OR _sourceCategory="network/cisco" OR _sourceCategory="syslog/cisco")
("vmanage" OR "sdwan-manager" OR "Catalyst SD-WAN Manager")
| where %"host" matches "*vmanage*" OR %"host" matches "*sdwan*"
| parse "*" as event_message nodrop
| where event_message matches "*privilege*escal*"
  OR event_message matches "*unauthorized*admin*"
  OR event_message matches "*output*encod*error*"
  OR event_message matches "*escape*fail*"
  OR (event_message matches "*dataservice*" AND (event_message matches "*401*" OR event_message matches "*403*"))
| count by _sourceHost, event_message
| where _count >= 2
| sort by _count desc

rule CVE_2026_20245_Cisco_SDWAN_Output_Encoding_Exploitation {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects potential exploitation of CVE-2026-20245 in Cisco Catalyst SD-WAN Manager"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-4uxFrdzx"

  events:
    ($e1.metadata.product_name = /vmanage|sd-wan manager|catalyst sd-wan/i
      or $e1.target.hostname = /vmanage|sdwan.?manager|sdwanmgr/i)
    and (
      $e1.metadata.description = /privilege.escal/i
      or $e1.metadata.description = /unauthorized.*admin/i
      or $e1.metadata.description = /output.*encod.*error/i
      or $e1.metadata.description = /escape.*fail/i
      or ($e1.network.http.response_code = 401 and $e1.network.http.request_url = /\/dataservice\//)
      or ($e1.network.http.response_code = 403 and $e1.network.http.request_url = /\/dataservice\//)
    )

  match:
    $e1.target.hostname over 10m

  outcome:
    $risk_score = max(85)
    $target_host = $e1.target.hostname
    $product = $e1.metadata.product_name

  condition:
    #e1 >= 2
}

#event_simpleName in ("NetworkConnectIP4", "NetworkReceiveAcceptIP4", "ProcessRollup2", "SyntheticProcessRollup2")
| HostName = /vmanage|sdwan.?manager|sdwanmgr/i
  OR ImageFileName = /vmanage|sdwan/i
| eval suspicious = case(
    CommandLine = /privilege.escal/i, "PrivilegeEscalation",
    CommandLine = /unauthorized.*admin/i, "UnauthorizedAdmin",
    RemotePort in (443, 8443) AND ConnectionDirection = "1", "InboundMgmtConnection",
    ImageFileName = /sh|bash|python/ AND ParentBaseFileName = /vmanage|java/, "ShellSpawnedFromSDWAN",
    true(), "Other"
)
| suspicious != "Other"
| groupby([HostName, suspicious, ImageFileName, CommandLine], function=count(1, as=event_count))
| sort(event_count, order=desc)
| limit 200