SonicWall SMA1000 Appliance Management Console Path-Traversal Code Injection (remove_hotfix)

#!/bin/bash
# check_cve_2026_15410.sh — SonicWall SMA1000 CVE-2026-15410 version checker
# Run on the SMA1000 appliance as root via SSH or console.
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

VERSION_FILE="/etc/build_version"
ALT_VERSION_FILE="/etc/sonic_build"

if [ -f "$VERSION_FILE" ]; then
  BUILD=$(cat "$VERSION_FILE" | tr -d '[:space:]')
elif [ -f "$ALT_VERSION_FILE" ]; then
  BUILD=$(grep -oP '[0-9]+\.[0-9]+\.[0-9]+-[0-9]+' "$ALT_VERSION_FILE" | head -1)
else
  # Fallback: try to extract from running process or system info
  BUILD=$(strings /usr/local/bin/ctrl-service 2>/dev/null | grep -oP '[0-9]+\.[0-9]+\.[0-9]+-[0-9]+' | head -1)
fi

if [ -z "$BUILD" ]; then
  echo "UNKNOWN — could not determine firmware version. Verify manually."
  echo "Check: Settings > Firmware in the AMC, or run 'cat /etc/build_version'"
  exit 2
fi

echo "Detected firmware build: $BUILD"

# Extract major.minor.patch and hotfix number
BRANCH=$(echo "$BUILD" | grep -oP '^[0-9]+\.[0-9]+\.[0-9]+')
HOTFIX=$(echo "$BUILD" | grep -oP '(?<=-)[0-9]+$')

if [ -z "$BRANCH" ] || [ -z "$HOTFIX" ]; then
  echo "UNKNOWN — could not parse version components from '$BUILD'."
  exit 2
fi

case "$BRANCH" in
  12.4.3)
    if [ "$HOTFIX" -ge 3453 ]; then
      echo "PATCHED — build $BUILD is >= 12.4.3-03453."
      exit 0
    else
      echo "VULNERABLE — build $BUILD is below 12.4.3-03453. Patch immediately."
      exit 1
    fi
    ;;
  12.5.0)
    if [ "$HOTFIX" -ge 2835 ]; then
      echo "PATCHED — build $BUILD is >= 12.5.0-02835."
      exit 0
    else
      echo "VULNERABLE — build $BUILD is below 12.5.0-02835. Patch immediately."
      exit 1
    fi
    ;;
  *)
    # Versions outside 12.4.3 and 12.5.0 — may not be affected or may be EOL
    echo "UNKNOWN — branch $BRANCH is not in the known affected range (12.4.3 / 12.5.0)."
    echo "If this is an older branch, it may be EOL and unpatched. Contact SonicWall support."
    exit 2
    ;;
esac