Fortinet FortiSandbox pre-auth OS command injection via VNC web UI endpoint

#!/usr/bin/env bash
# check_cve_2026_25089.sh — Detect CVE-2026-25089 on FortiSandbox
# Usage: bash check_cve_2026_25089.sh <host> <user>
# Requires: ssh access to the FortiSandbox CLI, admin credentials
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

HOST="${1:-}"
USER="${2:-admin}"

if [[ -z "$HOST" ]]; then
  echo "Usage: $0 <fortisandbox-ip-or-hostname> [username]"
  echo "UNKNOWN - no host provided"
  exit 2
fi

echo "[*] Connecting to FortiSandbox at $HOST as $USER ..."
VERSION_OUTPUT=$(ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no "${USER}@${HOST}" \
  'get system status' 2>/dev/null) || {
  echo "UNKNOWN - SSH connection failed to $HOST"
  exit 2
}

# Extract version line, e.g., "Version: FortiSandbox v5.0.5 build0123"
VER_LINE=$(echo "$VERSION_OUTPUT" | grep -i '^Version' | head -1)
if [[ -z "$VER_LINE" ]]; then
  echo "UNKNOWN - could not parse version from 'get system status'"
  echo "Raw output: $VERSION_OUTPUT"
  exit 2
fi

echo "[*] Detected: $VER_LINE"

# Extract major.minor.patch
VERSION=$(echo "$VER_LINE" | grep -oP 'v\K[0-9]+\.[0-9]+\.[0-9]+')
if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN - could not extract version number from: $VER_LINE"
  exit 2
fi

MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)
PATCH=$(echo "$VERSION" | cut -d. -f3)

echo "[*] Parsed version: $MAJOR.$MINOR.$PATCH"

# Vulnerable ranges:
# 4.2.x — all versions (no public patch)
# 4.4.0 - 4.4.8
# 5.0.0 - 5.0.5
# Fixed: 4.4.9+, 5.0.6+

VULNERABLE=false

if [[ "$MAJOR" -eq 4 && "$MINOR" -eq 2 ]]; then
  echo "[!] Version 4.2.x — ALL versions vulnerable, no public patch available"
  VULNERABLE=true
elif [[ "$MAJOR" -eq 4 && "$MINOR" -eq 4 ]]; then
  if [[ "$PATCH" -le 8 ]]; then
    echo "[!] Version 4.4.$PATCH is in vulnerable range (4.4.0–4.4.8)"
    VULNERABLE=true
  else
    echo "[+] Version 4.4.$PATCH is patched (>= 4.4.9)"
  fi
elif [[ "$MAJOR" -eq 5 && "$MINOR" -eq 0 ]]; then
  if [[ "$PATCH" -le 5 ]]; then
    echo "[!] Version 5.0.$PATCH is in vulnerable range (5.0.0–5.0.5)"
    VULNERABLE=true
  else
    echo "[+] Version 5.0.$PATCH is patched (>= 5.0.6)"
  fi
else
  echo "[?] Version $VERSION is outside known affected ranges"
  echo "UNKNOWN - verify manually against Fortinet advisory FG-IR-26-141"
  exit 2
fi

if $VULNERABLE; then
  echo ""
  echo "========================================"
  echo "  VULNERABLE — CVE-2026-25089 applies"
  echo "  Upgrade to 4.4.9+ or 5.0.6+ NOW"
  echo "========================================"
  exit 1
else
  echo ""
  echo "========================================"
  echo "  PATCHED — CVE-2026-25089 remediated"
  echo "========================================"
  exit 0
fi