SonicOS post-authentication format string denial-of-service in the management plane

#!/usr/bin/env python3
# check_cve_2026_0400.py
# Determine likely exposure to CVE-2026-0400 from a SonicOS version string.
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / unable to classify

import re
import sys


def parse_version(v):
    m = re.match(r'^\s*(\d+)\.(\d+)\.(\d+)-(\d+)\s*$', v)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a, b):
    return (a > b) - (a < b)


def classify(vstr):
    v = parse_version(vstr)
    if v is None:
        return ("UNKNOWN", 2, "Version must look like 7.3.1-7013")

    # Best-available evidence used:
    # - CNA affected: 7.0.1-5169 and older; 7.3.1-7013 and older; 8.1.0-8017 and older
    # - NVD CPE mapping: vulnerable before 7.3.2-7010 and before 8.2.0-8009 on covered Gen7/Gen8 models
    # Because SonicWall branch entitlement / hotfix mapping is not fully machine-readable here,
    # some trains are intentionally reported as UNKNOWN rather than guessed.

    if v[0] == 7:
        # Explicitly affected older branch from CNA
        if v[:3] == (7, 0, 1):
            if v[3] <= 5169:
                return ("VULNERABLE", 1, "CNA lists 7.0.1-5169 and older as affected")
            return ("PATCHED", 0, "Later than 7.0.1-5169")

        # NVD maps affected 7.x covered models to < 7.3.2-7010
        if v[:2] == (7, 3):
            if cmp_ver(v, (7, 3, 2, 7010)) < 0:
                return ("VULNERABLE", 1, "NVD CPE mapping shows affected builds before 7.3.2-7010")
            return ("PATCHED", 0, "At or above 7.3.2-7010")

        # 7.1.x / 7.2.x not explicitly exposed in accessible advisory text
        return ("UNKNOWN", 2, "7.1.x / 7.2.x mapping not confirmed from accessible vendor text")

    if v[0] == 8:
        # NVD maps 8.x covered models to < 8.2.0-8009; CNA explicitly lists 8.1.0-8017 and older
        if cmp_ver(v, (8, 2, 0, 8009)) < 0:
            return ("VULNERABLE", 1, "NVD CPE mapping shows affected builds before 8.2.0-8009")
        return ("PATCHED", 0, "At or above 8.2.0-8009")

    return ("UNKNOWN", 2, "Major version not covered by reviewed advisory data")


def main():
    if len(sys.argv) != 2:
        print("UNKNOWN - usage: python3 check_cve_2026_0400.py <version>")
        sys.exit(2)

    status, code, reason = classify(sys.argv[1])
    print(f"{status} - {reason}")
    sys.exit(code)


if __name__ == "__main__":
    main()