Dirty Cert: Cisco Smart Software Manager Silently Patched Post-Auth RCE via Certificate Upload (no CVE stated)

Key facts

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5812 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Cisco CSSM Dirty Cert - CSR Generate/Upload Chain With Output Fetch via /backend/settings/csr/upload (Exploitation)

Detects the Dirty Cert exploitation chain against Cisco Smart Software Manager (CSSM; post-auth command injection, CWE-78, no CVE stated by STAR Labs; possibly related to CVE-2026-76437, linkage unconfirmed). Flags PUT/POST to /backend/settings/csr/upload, the external entry point that carries the malicious intermediate_certificate, and correlates it with /backend/settings/csr/generate from the same source (CSR creation and attacker-CA signing; the attacker-signed intermediate lands in the appliance trust store, T1553.004) and a subsequent HTTPS GET of a non-static file (PoC output retrieval, T1071.001). Admin authentication is required, often via default admin credentials (T1078.001).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1078.001, T1078, T1553.004, T1071.001
• Data sources: nginx_access_logs (index=web, sourcetype=access_combined), CommonSecurityLog (WAF/proxy), webserver logsource
• Severity: high
• Confidence: high

Splunk SPL

index=web sourcetype=access_combined earliest=-24h | eval stage=case(in(method,"PUT","POST") AND like(uri_path,"%/backend/settings/csr/generate"),"generate", in(method,"PUT","POST") AND like(uri_path,"%/backend/settings/csr/upload"),"upload", method="GET" AND status=200 AND NOT like(uri_path,"/backend/%") AND NOT match(uri_path,"[.](js|css|map|png|jpe?g|gif|svg|ico|woff2?|html?)$"),"fetch") | where isnotnull(stage) | stats count min(eval(if(stage="upload",_time,null()))) as first_upload max(eval(if(stage="fetch",_time,null()))) as last_fetch sum(eval(if(stage="upload",1,0))) as uploads sum(eval(if(stage="generate",1,0))) as generates sum(eval(if(stage="fetch",1,0))) as fetches values(status) as http_status by src, host | where uploads>0 | eval csr_generated_same_src=if(generates>0,"yes","no"), fetch_after_upload=if(fetches>0 AND last_fetch>=first_upload,"yes","no") | convert ctime(first_upload) ctime(last_fetch) | table host src uploads generates fetches csr_generated_same_src fetch_after_upload http_status first_upload last_fetch

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| extend Stage = case(
    RequestMethod in~ ("PUT", "POST") and RequestURL has "/backend/settings/csr/generate", "generate",
    RequestMethod in~ ("PUT", "POST") and RequestURL has "/backend/settings/csr/upload", "upload",
    RequestMethod =~ "GET" and RequestURL !has "/backend/" and not(RequestURL matches regex @"\.(js|css|map|png|jpe?g|gif|svg|ico|woff2?|html?)(\?.*)?$"), "fetch",
    "")
| where Stage != ""
| summarize Uploads = countif(Stage == "upload"), Generates = countif(Stage == "generate"), Fetches = countif(Stage == "fetch"), FirstUpload = minif(TimeGenerated, Stage == "upload"), LastFetch = maxif(TimeGenerated, Stage == "fetch"), Urls = make_set(RequestURL, 10) by SourceIP, DestinationIP, DeviceVendor
| where Uploads > 0
| extend CsrGeneratedFromSameSource = Generates > 0, FetchAfterUpload = Fetches > 0 and LastFetch >= FirstUpload
| project FirstUpload, LastFetch, SourceIP, DestinationIP, DeviceVendor, Uploads, Generates, Fetches, CsrGeneratedFromSameSource, FetchAfterUpload, Urls

Sigma

title: Cisco CSSM Certificate Upload Endpoint Access (Dirty Cert)
id: 5b0c1e44-6a7d-5c2e-9f10-3a4b8d2e7101
status: experimental
description: Detects PUT requests to /backend/settings/csr/upload on Cisco Smart Software Manager, the entry point for the post-authentication command injection via a malicious intermediate_certificate (Dirty Cert). Exploitation needs an admin session, often obtained with default admin credentials; the uploaded attacker-signed intermediate is stored in the appliance trust store.
references:
    - https://starlabs.sg/blog/2026/09-dirty-cert-cisco-smart-software-managers-silently-patched-rce/
    - https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-ssm-access-nttb2dhE.html
author: Threadlinqs Team
date: 2026-11-12
tags:
    - attack.initial-access
    - attack.defense-evasion
    - attack.persistence
    - attack.t1190
    - attack.t1078
    - attack.t1078.001
    - attack.t1553.004
logsource:
    category: webserver
detection:
    selection:
        cs-method: 'PUT'
        c-uri|contains: '/backend/settings/csr/upload'
    condition: selection
falsepositives:
    - Legitimate administrator uploading a CA-signed certificate during certificate renewal
    - Authorized vulnerability scans or penetration tests of the CSSM certificate workflow
level: high

Known false positives:

• Legitimate administrator uploading a CA-signed certificate during planned certificate renewal
• Vulnerability scanners or authorized penetration tests exercising the CSSM certificate workflow
• Admin browsing dynamic UI pages after a certificate change can trip the fetch stage (fetch is only a priority signal; an upload alone already alerts)

Tuning notes: Certificate uploads are rare on CSSM, so alert on any upload and raise priority when csr_generated_same_src=yes, fetch_after_upload=yes, or the source is outside the admin network. Scope the search to the CSSM host(s) (host=) to keep the GET branch cheap. Adjust index/sourcetype and field names (uri_path, method, status, src) to your nginx or reverse-proxy ingestion and allowlist change-window admin hosts. Pair with SPL-002 (shell child of the configurator) for confirmation.

• 🔒 Cisco CSSM Dirty Cert - CSR Generate/Upload Chain With Output Fetch (Exploitation, KQL) · unlock with TL Creds
• 🔒 Cisco CSSM Dirty Cert - Shell Injection in nginx_configurator openssl Call (Post-Exploitation, KQL) · unlock with TL Creds
• 🔒 Cisco CSSM Dirty Cert - Output File Created in nginx Web Root Then Deleted (KQL) · unlock with TL Creds
• 🔒 Cisco CSSM Dirty Cert - Certificate Upload Endpoint Access (Exploitation, Sigma) · unlock with TL Creds
• 🔒 Cisco CSSM Dirty Cert - Shell Injection in nginx_configurator openssl Call (Post-Exploitation, Sigma) · unlock with TL Creds
• 🔒 Cisco CSSM Dirty Cert - Output Staged in nginx Web Root and Removed (Sigma) · unlock with TL Creds
• 🔒 Cisco CSSM Dirty Cert - Shell Injection in nginx_configurator openssl Call (Post-Exploitation) · unlock with TL Creds
• 🔒 Cisco CSSM Dirty Cert - Output File Created in nginx Web Root Then Deleted (Output Staging / Cleanup) · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 9 indicators of compromise for TL-2026-5812.

Technical analysis

Cisco fixed it silently in 10-202608, and the article includes a full PoC.

Yap Yuan Xi of STAR Labs published a write-up on 2026-09-24 of a post-authentication command injection in Cisco Smart Software Manager (CSSM), delivered as an installable OS that runs microservices behind an nginx reverse proxy. The author tested version 10-202606 as vulnerable. Cisco released 10-202608 on 2026-08-10 without a CVE or advisory text for this bug, and the sink was removed there. The author dates discovery to 2026-08-09, found by an AI-assisted hunting harness, and confirmed the fix by patch analysis on 2026-08-19.

The sink is in /frontend/usr/share/nginx/nginx_configurator/main.js. The functions valid_key(key) and valid_cert(cert) build shell commands from user-controlled input and run them with childProcess.execSync, for example echo "${cert}" | openssl x509 > /dev/null. They are reached during certificate upload via app.put('/certs/:type', saveKeyAndCert). The external entry point is PUT /backend/settings/csr/upload, which nginx proxies to the backend.

The backend validator (upload_validator.rb) checks that a CSR exists, that the certificate matches it, that the intermediate signed the leaf, and that the algorithm is allowlisted. An attacker satisfies these by generating a CSR through /backend/settings/csr/generate, creating their own CA and signing the CSR. Ruby's OpenSSL::X509::Certificate.new tolerates explanatory text before the -----BEGIN CERTIFICATE----- header, as RFC 7468 permits. The leaf certificate is normalized by to_pem, which strips that text, so the payload cannot ride in the leaf. The intermediate_certificate, however, is stored as-is in TrustStoreCert, and build_pem_bundle later sends it to the frontend. There valid_cert passes the bundle to execSync and the injected command substitution runs.

The PoC script (per the article) logs in as admin using default admin credentials, generates a CSR, signs it with a self-made CA, uploads the leaf with a malicious intermediate_certificate, redirects command output to a file in the nginx web root, fetches that file over HTTPS and then deletes it. Code runs with nginx permissions, which the article states are root on that microservice. Exploitation requires admin authentication.

The fix replaced the execSync calls with Node.js crypto APIs: crypto.createPrivateKey(key) with an RSA key-type check, and new crypto.X509Certificate(cert).

CVE correlation (unconfirmed): the article states no CVE. Cisco advisory cisco-sa-ssm-access-nttb2dhE (published 2026-10-07, fixed in 10-202608) covers Cisco License (Smart Software Manager) On-Prem and lists CVE-2026-76437, an admin-authenticated command injection in the web management interface (CVSS 4.9, CWE-78, credited to Gabriele Paris of NATO NCSC, not STAR Labs). The advisory does not mention certificate upload, so this record does not assert that it is the same bug. No in-the-wild exploitation is reported: Cisco PSIRT states it is not aware of public announcements or malicious use of the advisory's CVEs. Severity HIGH is an analyst estimate because root-level RCE is reachable once admin access is held; Cisco's own score for the possibly related CVE is lower because of the PR:H requirement.

MITRE ATT&CK techniques by tactic:

Execution

T1059.004 Command and Scripting Interpreter: Unix Shell

Defense Evasion

T1070.004 Indicator Removal: File Deletion

Collection

T1074.001 Data Staged: Local Data Staging

Initial Access

T1078.001 Valid Accounts: Default Accounts; T1190 Exploit Public-Facing Application

Remediation

Patches

• Cisco Smart Software Manager 10-202608 (released 2026-08-10) replaces execSync with crypto.createPrivateKey and crypto.X509Certificate

Immediate actions

• Upgrade Cisco Smart Software Manager / Cisco License On-Prem to 10-202608 or later
• Change default admin credentials on all CSSM instances and restrict the management interface to trusted admin networks
• Review web server logs for PUT requests to /backend/settings/csr/upload and /backend/settings/csr/generate from unexpected sources
• Check the nginx web root on CSSM hosts for unexpected files created outside normal deployments

Workarounds

• None published by the source. Cisco advisory cisco-sa-ssm-access-nttb2dhE lists no workarounds for the related On-Prem CVEs

Longer-term hardening

• Do not expose the CSSM web interface to the internet
• Monitor for shell child processes (sh, bash, openssl) spawned by the nginx configurator node process
• Audit custom code for child_process exec/execSync usage with user-controlled input

Affected and fixed versions

• Cisco — Smart Software Manager (CSSM) / Cisco License On-Prem
  Vulnerable versions: 10-202606
  Fixed in: 10-202608

Timeline

• 2026-08-09 STAR Labs researcher Yap Yuan Xi discovers the CSSM certificate-upload command injection using an AI-assisted hunting harness (per the article)
• 2026-08-10 Cisco releases CSSM 10-202608, silently removing the execSync sink; no CVE or advisory text for this bug in the article
• 2026-08-18 Researcher prepares the vulnerability report
• 2026-08-19 Researcher analyzes 10-202608 and confirms the sink was replaced by crypto.createPrivateKey and crypto.X509Certificate
• 2026-09-24 STAR Labs publishes 'Dirty Cert' with a full PoC script
• 2026-10-07 Cisco publishes advisory cisco-sa-ssm-access-nttb2dhE for Cisco License On-Prem, including admin-authenticated command injection CVE-2026-76437 fixed in 10-202608; the advisory does not mention certificate upload, so linkage to this bug is unconfirmed

Sources cited

• CVE-2026-76437 - Cisco License On-Prem Command Injection (OpenCVE) app.opencve.io · Advisory · 2026-10-07
• Dirty Cert: Cisco Smart Software Manager's Silently Patched RCE (STAR Labs, Yap Yuan Xi) starlabs.sg · Research · 2026-09-24
• Cisco License (Smart Software Manager) On-Prem Vulnerabilities - cisco-sa-ssm-access-nttb2dhE Cisco · Vendor report · 2026-10-07
• Cisco Security Advisory (Cisco Security Center) Cisco · Vendor report · 2026-10-07
• RFC 7468 - Textual Encodings of PKIX, PKCS, and CMS Structures rfc-editor.org · Research · 2015-04-01
• Cisco Patches Critical Smart Software Manager On-Prem Vulnerabilities (eSecurity Planet) esecurityplanet.com · News · 2026-10-07

More in vulnerability

• Palo Alto Networks PAN-OS (Panorama) Code Injection RCE as Root - CVE-2026-0330
• SignDrop: Unpatched Windows CLFS Zero-Day Enables Local Privilege Escalation to SYSTEM (No CVE)
• Titan Quest: Anniversary Edition heap overflow in .lvl/.pfx file parsing exploited via malicious custom maps (no CVE)
• Microsoft AI-Assisted Research Discloses 59 Linux Kernel Bug Reports (33 CVEs) Incl. 21-Year-Old cls_u32 Flaw CVE-2026-74544; Local Root LPE Exploits Confirmed for 8 CVEs
• Node.js November 2026 Security Releases Patch 16 Vulnerabilities (HTTP/2 crashes, HTTPS heap/TLS key leak CVE-2026-123864, TLS client-certificate auth bypass)

Other reports on CVE-2026-76437

• Cisco October 2026 Security Advisories: Critical Flaws in Meraki, License (SSM) On-Prem, NX-OS, APIC and Finesse (CVE-2026-76464, CVE-2026-20328, CVE-2026-76485 and others)

Previous and next in vulnerability

• OpenCode Remote Code Execution via /global/upgrade Content-Type Confusion and Cross-Site Request (GHSA-632h-h47v-g4x4) Previous report