PAN-OS Management Interface Authenticated Remote Code Execution

#!/usr/bin/env python3
"""CVE-2026-0322 PAN-OS Version Checker
Checks if a Palo Alto Networks firewall is running a vulnerable PAN-OS version.
Usage: python3 check_cve_2026_0322.py <firewall_host> <api_key>
Exit codes: 0=PATCHED, 1=VULNERABLE, 3=UNKNOWN
"""
import sys
import re
import xml.etree.ElementTree as ET

try:
    import requests
    requests.packages.urllib3.disable_warnings()
except ImportError:
    print("UNKNOWN - 'requests' library required: pip install requests")
    sys.exit(3)

# Latest fixed version per branch (conservative check)
FIXED = {
    "12.2": (12, 2, 4, 0),
    "12.1": (12, 1, 10, 2),
    "11.2": (11, 2, 16, 0),
    "11.1": (11, 1, 16, 3),
    "10.2": (10, 2, 18, 12),
}

def parse_version(v):
    """Parse '11.2.13-h3' into (11, 2, 13, 3) or '11.2.16' into (11, 2, 16, 0)."""
    m = re.match(r'^(\d+)\.(\d+)\.(\d+)(?:-h(\d+))?', v)
    if not m:
        return None
    return (int(m.group(1)), int(m.group(2)), int(m.group(3)), int(m.group(4) or 0))

def main():
    if len(sys.argv) != 3:
        print("Usage: python3 check_cve_2026_0322.py <host> <api_key>")
        sys.exit(3)
    host, api_key = sys.argv[1], sys.argv[2]
    url = f"https://{host}/api/?type=version&key={api_key}"
    try:
        r = requests.get(url, verify=False, timeout=15)
        r.raise_for_status()
    except Exception as e:
        print(f"UNKNOWN - Connection failed: {e}")
        sys.exit(3)
    try:
        root = ET.fromstring(r.text)
        sw_elem = root.find('.//sw-version')
        if sw_elem is None or not sw_elem.text:
            print("UNKNOWN - No <sw-version> in API response")
            sys.exit(3)
        running_str = sw_elem.text.strip()
    except ET.ParseError:
        print("UNKNOWN - Could not parse XML response")
        sys.exit(3)
    running = parse_version(running_str)
    if running is None:
        print(f"UNKNOWN - Unrecognized version format: {running_str}")
        sys.exit(3)
    branch = f"{running[0]}.{running[1]}"
    if branch not in FIXED:
        branch_num = running[0] * 10 + running[1]
        if branch_num < 102:  # older than 10.2
            print(f"VULNERABLE - PAN-OS {running_str} is EOL, no patch available for CVE-2026-0322")
            sys.exit(1)
        else:
            print(f"UNKNOWN - Branch {branch} not in known affected range")
            sys.exit(3)
    fixed = FIXED[branch]
    if running >= fixed:
        print(f"PATCHED - PAN-OS {running_str} >= {fixed[0]}.{fixed[1]}.{fixed[2]}-h{fixed[3] if fixed[3] else '0'}")
        sys.exit(0)
    else:
        print(f"VULNERABLE - PAN-OS {running_str} is below fixed version for branch {branch}")
        sys.exit(1)

if __name__ == "__main__":
    main()