Check Point Security Management Server SmartConsole Authentication Bypass via Forged SIC DN Application Token

#!/bin/bash
# check_cve_2026_16232.sh — Verify patch status for CVE-2026-16232
# Run on Check Point SMS/MDS in expert mode (Gaia shell)
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

echo "[*] CVE-2026-16232 Check — Check Point SmartConsole Auth Bypass"
echo "[*] Date: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
echo ""

# Determine version and hotfix take
VERSION=$(clish -c 'show version product' 2>/dev/null | grep -oP 'R[0-9]+\.?[0-9]*' | head -1 || echo "UNKNOWN")
TAKE=$(cpinfo -y fw1 2>/dev/null | grep -i 'jumbo.*take' | grep -oP '[0-9]+' | tail -1 || echo "0")

if [ "$VERSION" = "UNKNOWN" ]; then
    echo "[!] Could not determine Check Point version."
    echo "UNKNOWN"
    exit 2
fi

echo "[*] Detected version: $VERSION"
echo "[*] Detected Jumbo Hotfix Take: ${TAKE:-none}"

VULNERABLE=0

case "$VERSION" in
    R82.10)
        if [ "${TAKE:-0}" -lt 36 ]; then
            VULNERABLE=1
            echo "[!] R82.10 requires Take 36+. Installed: Take ${TAKE:-none}"
        fi
        ;;
    R82)
        if [ "${TAKE:-0}" -lt 118 ]; then
            VULNERABLE=1
            echo "[!] R82 requires Take 118+. Installed: Take ${TAKE:-none}"
        fi
        ;;
    R81.20)
        if [ "${TAKE:-0}" -lt 158 ]; then
            VULNERABLE=1
            echo "[!] R81.20 requires Take 158+. Installed: Take ${TAKE:-none}"
        fi
        ;;
    R81.10|R81|R80*|R77*)
        VULNERABLE=1
        echo "[!] $VERSION has NO available fix. Upgrade to R81.20+ required."
        ;;
    *)
        echo "[!] Unrecognized version: $VERSION"
        echo "UNKNOWN"
        exit 2
        ;;
esac

# Check Trusted Clients setting
echo ""
echo "[*] Checking Trusted Clients (GUI Clients) configuration..."
TC=$(cpmiquerybin attr '' Network Objects "$(hostname)" trusted_client_list 2>/dev/null || echo "QUERY_FAILED")
if echo "$TC" | grep -qi 'any\|0\.0\.0\.0'; then
    echo "[!] WARNING: Trusted Clients is set to ANY — management is reachable from all IPs."
    echo "[!] Restrict immediately to authorized admin IPs/subnets."
elif [ "$TC" = "QUERY_FAILED" ]; then
    echo "[?] Could not query Trusted Clients programmatically."
    echo "    Manually verify in SmartConsole → Server Properties → Trusted Clients."
else
    echo "[+] Trusted Clients appears restricted (not set to Any)."
fi

# Check if management ports are listening on all interfaces
echo ""
echo "[*] Checking management port bindings..."
for PORT in 18190 19009; do
    BINDING=$(ss -tlnp 2>/dev/null | grep ":${PORT}" | awk '{print $4}' || echo "")
    if [ -n "$BINDING" ]; then
        echo "[*] Port $PORT listening on: $BINDING"
    else
        echo "[*] Port $PORT: not detected in listener list"
    fi
done

echo ""
if [ "$VULNERABLE" -eq 1 ]; then
    echo "VULNERABLE"
    exit 1
else
    echo "PATCHED"
    exit 0
fi