{"id":1697,"date":"2026-06-26T07:23:16","date_gmt":"2026-06-26T00:23:16","guid":{"rendered":"https:\/\/vncybers.vn\/cisco-catalyst-sd-wan-zero-day-cve-2026-20245-chiem-quyen-root\/"},"modified":"2026-06-26T07:23:16","modified_gmt":"2026-06-26T00:23:16","slug":"cisco-catalyst-sd-wan-zero-day-cve-2026-20245-chiem-quyen-root","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/cisco-catalyst-sd-wan-zero-day-cve-2026-20245-chiem-quyen-root\/","title":{"rendered":"Cisco Catalyst SD-WAN b\u1ecb khai th\u00e1c zero-day CVE-2026-20245 \u0111\u1ec3 chi\u1ebfm quy\u1ec1n root"},"content":{"rendered":"

Mandiant thu\u1ed9c Google Cloud ng\u00e0y 25\/06\/2026 c\u00f4ng b\u1ed1 ph\u00e2n t\u00edch v\u1ec1 m\u1ed9t chi\u1ebfn d\u1ecbch khai th\u00e1c l\u1ed7 h\u1ed5ng zero-day trong Cisco Catalyst SD-WAN Manager. L\u1ed7 h\u1ed5ng \u0111\u01b0\u1ee3c theo d\u00f5i l\u00e0 CVE-2026-20245, cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng \u0111\u00e3 c\u00f3 quy\u1ec1n c\u1ee5c b\u1ed9\/x\u00e1c th\u1ef1c tr\u00ean h\u1ec7 th\u1ed1ng th\u1ef1c thi l\u1ec7nh v\u1edbi \u0111\u1eb7c quy\u1ec1n root th\u00f4ng qua t\u1ec7p t\u1ea3i l\u00ean \u0111\u01b0\u1ee3c ch\u1ebf t\u1ea1o \u0111\u1eb7c bi\u1ec7t.<\/p>\n

V\u1ee5 vi\u1ec7c \u0111\u00e1ng ch\u00fa \u00fd v\u00ec m\u1ee5c ti\u00eau kh\u00f4ng ph\u1ea3i m\u00e1y tr\u1ea1m hay m\u00e1y ch\u1ee7 \u1ee9ng d\u1ee5ng th\u00f4ng th\u01b0\u1eddng, m\u00e0 l\u00e0 thi\u1ebft b\u1ecb \u0111i\u1ec1u ph\u1ed1i m\u1ea1ng bi\u00ean. C\u00e1c h\u1ec7 th\u1ed1ng SD-WAN th\u01b0\u1eddng gi\u1eef vai tr\u00f2 trung t\u00e2m trong vi\u1ec7c k\u1ebft n\u1ed1i chi nh\u00e1nh, trung t\u00e2m d\u1eef li\u1ec7u v\u00e0 d\u1ecbch v\u1ee5 \u0111\u00e1m m\u00e2y. Khi l\u1edbp \u0111i\u1ec1u khi\u1ec3n n\u00e0y b\u1ecb x\u00e2m nh\u1eadp, k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 c\u00f3 v\u1ecb tr\u00ed thu\u1eadn l\u1ee3i \u0111\u1ec3 quan s\u00e1t c\u1ea5u h\u00ecnh, duy tr\u00ec hi\u1ec7n di\u1ec7n v\u00e0 che gi\u1ea5u d\u1ea5u v\u1ebft kh\u1ecfi c\u00e1c c\u00f4ng c\u1ee5 EDR truy\u1ec1n th\u1ed1ng.<\/p>\n

\"Minh<\/p>\n

Di\u1ec5n bi\u1ebfn ch\u00ednh c\u1ee7a chi\u1ebfn d\u1ecbch<\/h2>\n

Theo Mandiant, ho\u1ea1t \u0111\u1ed9ng \u0111\u00e1ng ng\u1edd b\u1eaft \u0111\u1ea7u t\u1eeb cu\u1ed1i n\u0103m 2025 \u0111\u1ebfn th\u00e1ng 01\/2026 v\u1edbi c\u00e1c k\u1ebft n\u1ed1i peering tr\u00e1i ph\u00e9p v\u00e0o thi\u1ebft b\u1ecb SD-WAN Manager c\u1ee7a m\u1ed9t nh\u00e0 cung c\u1ea5p d\u1ecbch v\u1ee5 truy\u1ec1n th\u00f4ng. \u0110\u1ebfn th\u00e1ng 03\/2026, nh\u00f3m t\u1ea5n c\u00f4ng ti\u1ebfp t\u1ee5c t\u1ea1o k\u1ebft n\u1ed1i peering m\u1edbi, sau \u0111\u00f3 x\u00e1c th\u1ef1c qua SSH b\u1eb1ng t\u00e0i kho\u1ea3n m\u1eb7c \u0111\u1ecbnh trong m\u00f4i tr\u01b0\u1eddng Cisco Catalyst SD-WAN.<\/p>\n

Sau khi c\u00f3 quy\u1ec1n truy c\u1eadp, k\u1ebb t\u1ea5n c\u00f4ng thay \u0111\u1ed5i m\u1eadt kh\u1ea9u t\u00e0i kho\u1ea3n qu\u1ea3n tr\u1ecb m\u1eb7c \u0111\u1ecbnh, \u0111\u0103ng nh\u1eadp v\u00e0o giao di\u1ec7n web, tr\u00edch xu\u1ea5t c\u1ea5u h\u00ecnh SD-WAN fabric r\u1ed3i kh\u00f4i ph\u1ee5c m\u1eadt kh\u1ea9u v\u1ec1 tr\u1ea1ng th\u00e1i ban \u0111\u1ea7u \u0111\u1ec3 gi\u1ea3m kh\u1ea3 n\u0103ng b\u1ecb qu\u1ea3n tr\u1ecb vi\u00ean ph\u00e1t hi\u1ec7n. Mandiant c\u0169ng ghi nh\u1eadn vi\u1ec7c k\u1ebb t\u1ea5n c\u00f4ng d\u00f9ng t\u1ec7p CSV \u0111\u1ed9c h\u1ea1i c\u00f3 t\u00ean evil_tenant.csv<\/strong> \u0111\u1ec3 khai th\u00e1c CVE-2026-20245 v\u00e0 t\u1ea1o t\u00e0i kho\u1ea3n troot<\/strong> c\u00f3 \u0111\u1eb7c quy\u1ec1n root.<\/p>\n

V\u00ec sao CVE-2026-20245 nguy hi\u1ec3m<\/h2>\n

CVE-2026-20245 xu\u1ea5t ph\u00e1t t\u1eeb c\u01a1 ch\u1ebf t\u1ea3i t\u1ec7p trong Cisco Catalyst SD-WAN Manager kh\u00f4ng l\u1ecdc \u0111\u1ea7y \u0111\u1ee7 d\u1eef li\u1ec7u \u0111\u1ed9c h\u1ea1i. Khi b\u1ecb khai th\u00e1c, l\u1ed7 h\u1ed5ng cho ph\u00e9p th\u1ef1c thi l\u1ec7nh \u1edf m\u1ee9c root. Cisco \u0111\u00e1nh gi\u00e1 l\u1ed7 h\u1ed5ng \u1edf m\u1ee9c nghi\u00eam tr\u1ecdng cao, \u0111\u1ed3ng th\u1eddi l\u01b0u \u00fd k\u1ebb t\u1ea5n c\u00f4ng c\u1ea7n c\u00f3 quy\u1ec1n netadmin ho\u1eb7c quy\u1ec1n c\u1ee5c b\u1ed9 t\u01b0\u01a1ng \u0111\u01b0\u01a1ng tr\u00ean h\u1ec7 th\u1ed1ng b\u1ecb \u1ea3nh h\u01b0\u1edfng \u0111\u1ec3 khai th\u00e1c th\u00e0nh c\u00f4ng.<\/p>\n

\u0110i\u1ec3m r\u1ee7i ro n\u1eb1m \u1edf chu\u1ed7i t\u1ea5n c\u00f4ng. N\u1ebfu \u0111\u1ed1i t\u01b0\u1ee3ng \u0111e d\u1ecda \u0111\u00e3 c\u00f3 quy\u1ec1n truy c\u1eadp ban \u0111\u1ea7u qua peering tr\u00e1i ph\u00e9p, ch\u1ee9ng ch\u1ec9 b\u1ecb \u0111\u00e1nh c\u1eafp ho\u1eb7c t\u00e0i kho\u1ea3n qu\u1ea3n tr\u1ecb b\u1ecb l\u1ed9, l\u1ed7 h\u1ed5ng leo thang \u0111\u1eb7c quy\u1ec1n n\u00e0y c\u00f3 th\u1ec3 bi\u1ebfn m\u1ed9t phi\u00ean truy c\u1eadp h\u1ea1n ch\u1ebf th\u00e0nh quy\u1ec1n ki\u1ec3m so\u00e1t s\u00e2u tr\u00ean thi\u1ebft b\u1ecb \u0111i\u1ec1u ph\u1ed1i m\u1ea1ng.<\/p>\n

\"Minh<\/p>\n

K\u1ef9 thu\u1eadt che gi\u1ea5u v\u00e0 d\u1ea5u hi\u1ec7u c\u1ea7n s\u0103n t\u00ecm<\/h2>\n

Mandiant cho bi\u1ebft k\u1ebb t\u1ea5n c\u00f4ng s\u1eed d\u1ee5ng nhi\u1ec1u k\u1ef9 thu\u1eadt ch\u1ed1ng \u0111i\u1ec1u tra s\u1ed1. Ch\u00fang x\u00f3a t\u1ec7p \u0111\u00e3 t\u1ea1o, kh\u00f4i ph\u1ee5c c\u1ea5u h\u00ecnh h\u1ec7 th\u1ed1ng, d\u1ecdn c\u00e1c b\u1ea3n sao t\u1ea1m th\u1eddi v\u00e0 ch\u1ea1y script ki\u1ec3m tra \u0111\u1ec3 ch\u1eafc ch\u1eafn ch\u1ec9 b\u00e1o x\u00e2m nh\u1eadp \u0111\u00e3 b\u1ecb lo\u1ea1i b\u1ecf. C\u00e1ch l\u00e0m n\u00e0y khi\u1ebfn vi\u1ec7c x\u00e1c \u0111\u1ecbnh \u0111\u1ea7y \u0111\u1ee7 ph\u1ea1m vi s\u1ef1 c\u1ed1 tr\u1edf n\u00ean kh\u00f3 kh\u0103n h\u01a1n, \u0111\u1eb7c bi\u1ec7t tr\u00ean thi\u1ebft b\u1ecb m\u1ea1ng v\u1ed1n th\u01b0\u1eddng thi\u1ebfu telemetry chuy\u00ean s\u00e2u.<\/p>\n

C\u00e1c \u0111\u1ed9i v\u1eadn h\u00e0nh n\u00ean \u01b0u ti\u00ean r\u00e0 so\u00e1t \u0111\u0103ng nh\u1eadp SSH b\u1ea5t th\u01b0\u1eddng b\u1eb1ng t\u00e0i kho\u1ea3n vmanage-admin<\/strong>, s\u1ef1 ki\u1ec7n \u0111\u1ed5i m\u1eadt kh\u1ea9u t\u00e0i kho\u1ea3n qu\u1ea3n tr\u1ecb trong th\u1eddi gian ng\u1eafn, d\u1ea5u v\u1ebft l\u1ec7nh su<\/strong> sang t\u00e0i kho\u1ea3n l\u1ea1, l\u1ecbch s\u1eed l\u1ec7nh li\u00ean quan \u0111\u1ebfn tenant-upload<\/strong> v\u00e0 b\u1ea5t k\u1ef3 d\u1ea5u hi\u1ec7u n\u00e0o cho th\u1ea5y t\u1ec7p evil_tenant.csv<\/strong> t\u1eebng xu\u1ea5t hi\u1ec7n tr\u00ean thi\u1ebft b\u1ecb.<\/p>\n

Khuy\u1ebfn ngh\u1ecb cho t\u1ed5 ch\u1ee9c s\u1eed d\u1ee5ng Cisco SD-WAN<\/h2>\n

Khuy\u1ebfn ngh\u1ecb quan tr\u1ecdng nh\u1ea5t l\u00e0 n\u00e2ng c\u1ea5p Cisco Catalyst SD-WAN Manager l\u00ean c\u00e1c b\u1ea3n \u0111\u00e3 \u0111\u01b0\u1ee3c Cisco kh\u1eafc ph\u1ee5c, bao g\u1ed3m c\u00e1c nh\u00e1nh 20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1, 26.1.1.2 ho\u1eb7c m\u1edbi h\u01a1n t\u00f9y m\u00f4i tr\u01b0\u1eddng. T\u1ed5 ch\u1ee9c c\u0169ng n\u00ean thu th\u1eadp g\u00f3i ch\u1ea9n \u0111o\u00e1n b\u1eb1ng l\u1ec7nh ph\u00f9 h\u1ee3p tr\u00ean c\u00e1c th\u00e0nh ph\u1ea7n control-plane, \u0111\u1ed1i chi\u1ebfu IOC do Mandiant c\u00f4ng b\u1ed1 v\u00e0 li\u00ean h\u1ec7 Cisco TAC n\u1ebfu ph\u00e1t hi\u1ec7n d\u1ea5u hi\u1ec7u nghi v\u1ea5n.<\/p>\n

V\u1ec1 d\u00e0i h\u1ea1n, s\u1ef1 c\u1ed1 n\u00e0y nh\u1eafc l\u1ea1i m\u1ed9t b\u00e0i h\u1ecdc quan tr\u1ecdng: thi\u1ebft b\u1ecb m\u1ea1ng bi\u00ean kh\u00f4ng c\u00f2n l\u00e0 l\u1edbp h\u1ea1 t\u1ea7ng t\u0129nh, \u00edt b\u1ecb nh\u1eafm t\u1edbi. Ch\u00fang c\u1ea7n \u0111\u01b0\u1ee3c qu\u1ea3n tr\u1ecb nh\u01b0 t\u00e0i s\u1ea3n tr\u1ecdng y\u1ebfu, c\u00f3 ki\u1ec3m so\u00e1t truy c\u1eadp ch\u1eb7t, ghi log \u0111\u1ea7y \u0111\u1ee7, ki\u1ec3m k\u00ea phi\u00ean b\u1ea3n th\u01b0\u1eddng xuy\u00ean v\u00e0 quy tr\u00ecnh s\u0103n t\u00ecm \u0111e d\u1ecda ri\u00eang cho nh\u1eefng n\u01a1i EDR kh\u00f4ng th\u1ec3 quan s\u00e1t.<\/p>\n

T\u00e1c \u0111\u1ed9ng \u0111\u1ed1i v\u1edbi doanh nghi\u1ec7p<\/h2>\n

V\u1edbi doanh nghi\u1ec7p ph\u00e2n t\u00e1n nhi\u1ec1u chi nh\u00e1nh, SD-WAN gi\u00fap t\u1ed1i \u01b0u k\u1ebft n\u1ed1i nh\u01b0ng \u0111\u1ed3ng th\u1eddi t\u1ea1o ra m\u1ed9t \u0111i\u1ec3m \u0111i\u1ec1u ph\u1ed1i c\u00f3 gi\u00e1 tr\u1ecb cao. M\u1ed9t s\u1ef1 c\u1ed1 \u1edf t\u1ea7ng n\u00e0y c\u00f3 th\u1ec3 \u1ea3nh h\u01b0\u1edfng \u0111\u1ebfn \u0111\u1ecbnh tuy\u1ebfn, c\u1ea5u h\u00ecnh b\u1ea3o m\u1eadt, quy\u1ec1n truy c\u1eadp gi\u1eefa c\u00e1c v\u00f9ng m\u1ea1ng v\u00e0 kh\u1ea3 n\u0103ng b\u1ea3o v\u1ec7 d\u1eef li\u1ec7u khi l\u01b0u l\u01b0\u1ee3ng \u0111i qua nhi\u1ec1u \u0111i\u1ec3m k\u1ebft n\u1ed1i kh\u00e1c nhau.<\/p>\n

Do \u0111\u00f3, CVE-2026-20245 kh\u00f4ng ch\u1ec9 l\u00e0 m\u1ed9t b\u1ea3n v\u00e1 k\u1ef9 thu\u1eadt. \u0110\u00e2y l\u00e0 l\u1eddi nh\u1eafc v\u1ec1 vi\u1ec7c c\u1ea7n gi\u1ea3m ph\u1ee5 thu\u1ed9c v\u00e0o t\u00e0i kho\u1ea3n m\u1eb7c \u0111\u1ecbnh, ki\u1ec3m tra ch\u1ee9ng ch\u1ec9 v\u00e0 peering, gi\u1edbi h\u1ea1n quy\u1ec1n qu\u1ea3n tr\u1ecb theo nguy\u00ean t\u1eafc t\u1ed1i thi\u1ec3u, \u0111\u1ed3ng th\u1eddi x\u00e2y d\u1ef1ng kh\u1ea3 n\u0103ng ph\u00e1t hi\u1ec7n h\u00e0nh vi b\u1ea5t th\u01b0\u1eddng tr\u00ean thi\u1ebft b\u1ecb \u0111i\u1ec1u khi\u1ec3n m\u1ea1ng.<\/p>\n

VNCyberS<\/strong> t\u1ed5ng h\u1ee3p t\u1eeb Google Cloud Mandiant, Cisco, The Hacker News v\u00e0 Wikimedia Commons<\/em><\/p>","protected":false},"excerpt":{"rendered":"

Mandiant thu\u1ed9c Google Cloud ng\u00e0y 25\/06\/2026 c\u00f4ng b\u1ed1 ph\u00e2n t\u00edch v\u1ec1 m\u1ed9t chi\u1ebfn d\u1ecbch khai th\u00e1c l\u1ed7 h\u1ed5ng zero-day trong Cisco Catalyst SD-WAN Manager. L\u1ed7 h\u1ed5ng \u0111\u01b0\u1ee3c theo d\u00f5i l\u00e0 CVE-2026-20245, cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng \u0111\u00e3 c\u00f3 quy\u1ec1n c\u1ee5c b\u1ed9\/x\u00e1c th\u1ef1c tr\u00ean h\u1ec7 th\u1ed1ng th\u1ef1c thi l\u1ec7nh v\u1edbi \u0111\u1eb7c quy\u1ec1n root th\u00f4ng qua t\u1ec7p […]<\/p>\n","protected":false},"author":2,"featured_media":1695,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[158,266,267,175,269,176,268,270,194,93],"class_list":["post-1697","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tin-tuc","tag-cisco","tag-cisco-catalyst-sd-wan","tag-cve-2026-20245","tag-google-cloud","tag-leo-thang-dac-quyen","tag-mandiant","tag-sd-wan","tag-thiet-bi-mang-bien","tag-threat-intelligence","tag-zero-day"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1697","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=1697"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1697\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/1695"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=1697"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=1697"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=1697"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}