A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling

#!/usr/bin/env bash
# CVE-2026-86131 - WatchGuard Fireware OS BOVPN Over TLS Code Injection
# Checks Fireware version against patched releases.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

FIREBOX="${1:?Usage: $0 <firebox_ip> [ssh_user]}"
SSH_USER="${2:-admin}"

# Fixed versions per branch:
#   2026.3.x  -> >= 2026.3.2
#   2025.x / 2026.0-2.x -> >= 2026.2.3
#   12.6-12.x -> >= 12.12.3
#   12.5.x (T15/T35) -> >= 12.5.21
#   12.0-12.4.x -> VULNERABLE (no fix in that branch)

echo "[*] Querying Firebox at ${FIREBOX} as ${SSH_USER}..."
RAW=$(ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new \
  "${SSH_USER}@${FIREBOX}" "show sysinfo" 2>/dev/null) || {
  echo "UNKNOWN - SSH connection to ${FIREBOX} failed"
  exit 2
}

VERSION=$(echo "$RAW" | grep -iE 'firmware.version|fireware.version' | head -1 | \
  sed 's/.*[: ] *//' | tr -d '[:space:]')

if [ -z "$VERSION" ]; then
  echo "UNKNOWN - Could not parse firmware version from ${FIREBOX}"
  exit 2
fi

echo "[*] Detected Fireware version: ${VERSION}"

# Also check if BOVPN Over TLS is configured
BOVPN_TLS=$(echo "$RAW" | grep -ci 'bovpn.*tls\|tls.*bovpn' || true)
if [ "$BOVPN_TLS" -eq 0 ]; then
  echo "[i] Note: No BOVPN Over TLS reference found in sysinfo."
  echo "[i] If BOVPN Over TLS is not configured, exposure is theoretical only."
fi

# Semantic version comparison: returns 0 if $1 >= $2
ver_gte() {
  [ "$(printf '%s\n' "$1" "$2" | sort -V | head -n1)" = "$2" ]
}

case "$VERSION" in
  2026.3.*)
    if ver_gte "$VERSION" "2026.3.2"; then
      echo "PATCHED - ${VERSION} >= 2026.3.2"; exit 0
    else
      echo "VULNERABLE - ${VERSION} < 2026.3.2 (CVE-2026-86131)"; exit 1
    fi ;;
  2026.*|2025.*)
    if ver_gte "$VERSION" "2026.2.3"; then
      echo "PATCHED - ${VERSION} >= 2026.2.3"; exit 0
    else
      echo "VULNERABLE - ${VERSION} < 2026.2.3 (CVE-2026-86131)"; exit 1
    fi ;;
  12.12.*|12.1[3-9].*|12.[2-9][0-9].*)
    if ver_gte "$VERSION" "12.12.3"; then
      echo "PATCHED - ${VERSION} >= 12.12.3"; exit 0
    else
      echo "VULNERABLE - ${VERSION} < 12.12.3 (CVE-2026-86131)"; exit 1
    fi ;;
  12.5.*)
    if ver_gte "$VERSION" "12.5.21"; then
      echo "PATCHED - ${VERSION} >= 12.5.21 (T15/T35 branch)"; exit 0
    else
      echo "VULNERABLE - ${VERSION} < 12.5.21 (CVE-2026-86131)"; exit 1
    fi ;;
  12.[6-9].*|12.1[0-1].*)
    echo "VULNERABLE - ${VERSION} is below 12.12.3; upgrade required (CVE-2026-86131)"
    exit 1 ;;
  12.[0-4].*)
    echo "VULNERABLE - ${VERSION} is in affected 12.x range; upgrade to >= 12.12.3 or >= 12.5.21 for T15/T35 (CVE-2026-86131)"
    exit 1 ;;
  *)
    echo "UNKNOWN - Unrecognized version format: ${VERSION}"
    exit 2 ;;
esac