Check Point Quantum Security Gateway IKE NAT-T improper length validation causes VPN service crash

#!/usr/bin/env bash
# Check Point Quantum Security Gateway local exposure check for CVE-2026-48132
# Outputs exactly one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

version=""
take=""
raw=""

# Collect evidence from common local sources.
if command -v clish >/dev/null 2>&1; then
  raw+="$(clish -c 'show version all' 2>/dev/null)"$'\n'
fi
if command -v cpinfo >/dev/null 2>&1; then
  raw+="$(cpinfo -y all 2>/dev/null | head -n 400)"$'\n'
fi
if [ -r /etc/cp-release ]; then
  raw+="$(cat /etc/cp-release 2>/dev/null)"$'\n'
fi

# Normalize whitespace for easier parsing.
flat=$(printf '%s' "$raw" | tr '\r' '\n' | sed 's/[[:space:]]\+/ /g')

# Try to detect the major release in descending specificity.
for v in R82.10 R82 R81.20 R81.10 R81 R80; do
  if printf '%s' "$flat" | grep -q "$v"; then
    version="$v"
    break
  fi
done

# Try multiple patterns for Jumbo Hotfix Take.
# Examples seen in the wild include: "Take 127", "Jumbo Hotfix Accumulator Take 127"
# We intentionally grab the highest visible Take number to reduce false negatives.
all_takes=$(printf '%s' "$flat" | grep -Eo 'Take[[:space:]]+[0-9]+' | grep -Eo '[0-9]+' || true)
if [ -n "$all_takes" ]; then
  take=$(printf '%s\n' "$all_takes" | sort -n | tail -1)
fi

# No version means we cannot assess.
if [ -z "$version" ]; then
  echo "UNKNOWN"
  exit 2
fi

# Helper for numeric compare when take is required.
need_take() {
  [ -n "$take" ] || { echo "UNKNOWN"; exit 2; }
}

case "$version" in
  R82.10)
    need_take
    if [ "$take" -le 19 ]; then
      echo "VULNERABLE"
      exit 1
    else
      echo "PATCHED"
      exit 0
    fi
    ;;
  R82)
    need_take
    if [ "$take" -le 91 ]; then
      echo "VULNERABLE"
      exit 1
    else
      echo "PATCHED"
      exit 0
    fi
    ;;
  R81.20)
    need_take
    if [ "$take" -le 127 ]; then
      echo "VULNERABLE"
      exit 1
    else
      echo "PATCHED"
      exit 0
    fi
    ;;
  R81.10|R81|R80)
    # Public secondary sources indicate R81.10 and below should be treated as affected.
    echo "VULNERABLE"
    exit 1
    ;;
  *)
    echo "UNKNOWN"
    exit 2
    ;;
esac