Check Point Quantum Security Gateway VPN ASN.1 Certificate Parsing Heap Buffer Overflow RCE

#!/bin/bash
# check_cve_2026_85103.sh
# Checks whether a Check Point Gaia gateway is vulnerable to CVE-2026-85103
# Run on the gateway itself in expert mode or via SSH as admin.
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

RESULT="UNKNOWN"

# Get the installed version and JHF take
VERSION=$(fw ver 2>/dev/null | grep -oP 'R\d+\.?\d*' | head -1)
JHF_TAKE=$(cpinfo -y all 2>/dev/null | grep -i 'Jumbo.*Take' | grep -oP '\d+' | tail -1)

if [ -z "$VERSION" ]; then
  echo "UNKNOWN - Could not determine Check Point version."
  exit 2
fi

echo "Detected version: $VERSION, JHF Take: ${JHF_TAKE:-none}"

case "$VERSION" in
  R82.20|R83*)
    RESULT="PATCHED"
    ;;
  R82.10)
    if [ -n "$JHF_TAKE" ] && [ "$JHF_TAKE" -ge 44 ]; then
      RESULT="PATCHED"
    else
      RESULT="VULNERABLE"
    fi
    ;;
  R82)
    if [ -n "$JHF_TAKE" ] && [ "$JHF_TAKE" -ge 126 ]; then
      RESULT="PATCHED"
    else
      RESULT="VULNERABLE"
    fi
    ;;
  R81.20)
    if [ -n "$JHF_TAKE" ] && [ "$JHF_TAKE" -ge 166 ]; then
      RESULT="PATCHED"
    else
      RESULT="VULNERABLE"
    fi
    ;;
  R81.10|R81|R80.40|R80.30|R80.20|R80)
    RESULT="VULNERABLE"
    echo "WARNING: End-of-support version detected. No patch available."
    ;;
  *)
    RESULT="UNKNOWN"
    ;;
esac

# Also check LivePatch status
LIVEPATCH=$(cpinfo -y all 2>/dev/null | grep -i 'livepatch\|LP-' | head -3)
if [ -n "$LIVEPATCH" ]; then
  echo "LivePatch info: $LIVEPATCH"
fi

echo "$RESULT"
case "$RESULT" in
  PATCHED)    exit 0 ;;
  VULNERABLE) exit 1 ;;
  *)          exit 2 ;;
esac