Check Point Quantum Security Gateway Pre-Auth RCE via VPN Certificate Trust Validation Bypass

#!/bin/bash
# check_cve_2026_85102.sh
# Checks whether a Check Point Gaia gateway is vulnerable to CVE-2026-85102
# Must be run in Expert mode (expert shell) on the gateway.
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

echo "=== CVE-2026-85102 Check ==="
echo "Check Point Quantum Security Gateway / Spark - VPN Certificate Validation RCE"
echo ""

# Check if we're in expert mode
if [ "$(id -u)" -ne 0 ]; then
    echo "ERROR: Must run in Expert mode (run 'expert' first)."
    echo "UNKNOWN"
    exit 2
fi

# Get version info
FW_VER=$(fw ver 2>/dev/null || echo "")
if [ -z "$FW_VER" ]; then
    echo "ERROR: Cannot determine firewall version. Is this a Check Point gateway?"
    echo "UNKNOWN"
    exit 2
fi

echo "Detected version: $FW_VER"

# Check if VPN blade is enabled (if not, not exploitable)
VPN_ENABLED=$(cpprod_util FwIsVpn 2>/dev/null || echo "0")
if [ "$VPN_ENABLED" = "0" ]; then
    echo "INFO: VPN blade is not enabled. Attack surface not present."
    echo "PATCHED"
    exit 0
fi
echo "VPN blade: ENABLED (attack surface present)"

# Parse major version
MAJOR=""
if echo "$FW_VER" | grep -qi "R82.10"; then
    MAJOR="R82.10"
elif echo "$FW_VER" | grep -qi "R82.00\|R82 "; then
    MAJOR="R82"
elif echo "$FW_VER" | grep -qi "R81.20"; then
    MAJOR="R81.20"
elif echo "$FW_VER" | grep -qi "R81.10"; then
    MAJOR="R81.10"
elif echo "$FW_VER" | grep -qi "R81 \|R81$"; then
    MAJOR="R81"
elif echo "$FW_VER" | grep -qi "R80"; then
    MAJOR="R80"
elif echo "$FW_VER" | grep -qi "R82.20"; then
    echo "Version R82.20 detected — NOT AFFECTED per vendor advisory."
    echo "PATCHED"
    exit 0
fi

echo "Parsed major version: $MAJOR"

# Get installed hotfix take number
HOTFIX_TAKE=0
INSTALLED_JUMBO=$(cpinfo -y fw1 2>/dev/null | grep -i "Jumbo\|HOTFIX" | head -1 || echo "")
if [ -n "$INSTALLED_JUMBO" ]; then
    HOTFIX_TAKE=$(echo "$INSTALLED_JUMBO" | grep -oP 'Take\s*\K[0-9]+' || echo "0")
fi

# Also try clish approach
if [ "$HOTFIX_TAKE" = "0" ]; then
    HOTFIX_TAKE=$(clish -c "show installer status" 2>/dev/null | grep -oP 'Take\s*\K[0-9]+' | tail -1 || echo "0")
fi

echo "Detected Jumbo Hotfix Take: $HOTFIX_TAKE"
echo ""

# Evaluate against patched thresholds
case "$MAJOR" in
    R82.10)
        if [ "$HOTFIX_TAKE" -ge 44 ]; then
            echo "R82.10 Take $HOTFIX_TAKE >= Take 44. Fix applied."
            echo "PATCHED"
            exit 0
        else
            echo "R82.10 Take $HOTFIX_TAKE < Take 44. VULNERABLE."
            echo "VULNERABLE"
            exit 1
        fi
        ;;
    R82)
        if [ "$HOTFIX_TAKE" -ge 126 ]; then
            echo "R82 Take $HOTFIX_TAKE >= Take 126. Fix applied."
            echo "PATCHED"
            exit 0
        else
            echo "R82 Take $HOTFIX_TAKE < Take 126. VULNERABLE."
            echo "VULNERABLE"
            exit 1
        fi
        ;;
    R81.20)
        if [ "$HOTFIX_TAKE" -ge 166 ]; then
            echo "R81.20 Take $HOTFIX_TAKE >= Take 166. Fix applied."
            echo "PATCHED"
            exit 0
        else
            echo "R81.20 Take $HOTFIX_TAKE < Take 166. VULNERABLE."
            echo "VULNERABLE"
            exit 1
        fi
        ;;
    R81.10)
        if [ "$HOTFIX_TAKE" -ge 190 ]; then
            echo "R81.10 Take $HOTFIX_TAKE >= Take 190. Fix applied."
            echo "PATCHED"
            exit 0
        else
            echo "R81.10 Take $HOTFIX_TAKE < Take 190. VULNERABLE."
            echo "VULNERABLE"
            exit 1
        fi
        ;;
    R81|R80)
        echo "$MAJOR is End of Support and has NO patch available."
        echo "VULNERABLE — upgrade to a supported release immediately."
        echo "VULNERABLE"
        exit 1
        ;;
    *)
        echo "Unable to determine patch status for version: $MAJOR"
        echo "UNKNOWN"
        exit 2
        ;;
esac