NetScaler ADC & Gateway TCP Timestamp memory overread (out-of-bounds read)

#!/usr/bin/env bash
# check-cve-2026-10817.sh — noisgate verification for CVE-2026-10817
# Requires: ssh, awk. Read-only nsroot or delegated read account.
set -u
NSIP="${1:-}"
USER="${2:-nsroot}"
if [[ -z "$NSIP" ]]; then
  echo "usage: $0 <NSIP> [user]" >&2
  exit 2
fi

# Pull version banner and TCP profile dump in one round trip.
OUT=$(ssh -o StrictHostKeyChecking=accept-new -o ConnectTimeout=10 \
      "${USER}@${NSIP}" \
      'show ns version; show ns tcpProfile' 2>/dev/null) || {
  echo "UNKNOWN: ssh failed to ${NSIP}"; exit 3; }

VER=$(printf '%s' "$OUT" | awk -F'NS' '/NetScaler NS/ {print $2; exit}' | awk '{print $1}')
if [[ -z "$VER" ]]; then echo "UNKNOWN: could not parse version"; exit 3; fi

# Fixed builds: 14.1-72.61, 13.1-63.18, 14.1-72.61-FIPS, 13.1-37.272
is_patched() {
  local v="$1"
  case "$v" in
    14.1-*) awk -v b="${v#14.1-}" 'BEGIN{split(b,a,"."); exit !(a[1]>72 || (a[1]==72 && a[2]>=61))}' ;;
    13.1-*) awk -v b="${v#13.1-}" 'BEGIN{split(b,a,"."); exit !(a[1]>63 || (a[1]==63 && a[2]>=18) || (a[1]==37 && a[2]>=272))}' ;;
    *) return 2 ;;
  esac
}

is_patched "$VER"; PATCH_RC=$?

# Any TCP profile with tcpTimestamp ENABLED is the exposure gate.
TS_ON=$(printf '%s' "$OUT" | awk '/TCPTIMESTAMP: ENABLED|tcpTimestamp: ENABLED/{c++} END{print c+0}')

echo "Version:       $VER"
echo "TCP profiles with Timestamp ENABLED: $TS_ON"

if [[ $PATCH_RC -eq 0 ]]; then
  echo "PATCHED"; exit 0
fi
if [[ $PATCH_RC -eq 2 ]]; then
  echo "UNKNOWN: unrecognized version scheme ($VER)"; exit 3
fi
if [[ $TS_ON -gt 0 ]]; then
  echo "VULNERABLE"; exit 1
fi
echo "VULNERABLE (unpatched build; disable TCP Timestamp is a mitigation, not a fix)"
exit 1