A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface.

#!/usr/bin/env python3
"""CVE-2026-86325 Checker — Moxa MGate Stack Buffer Overflow
Checks firmware version against known-vulnerable and fixed versions.
Usage: python3 check_cve_2026_86325.py <host> [--port PORT] [--https]
Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN
"""
import sys
import re
import argparse
import warnings

try:
    import requests
    from requests.packages.urllib3.exceptions import InsecureRequestWarning
    warnings.simplefilter('ignore', InsecureRequestWarning)
except ImportError:
    print("UNKNOWN - 'requests' library not installed. Run: pip install requests")
    sys.exit(2)

# Fixed firmware versions per model (from MPSA-269540)
FIXED_VERSIONS = {
    'MB3170': '4.7.1',
    'MB3270': '4.7.1',
    'MB3180': '2.7.1',
    'MB3280': '4.6.3',
    'MB3480': '4.5.1',
    'MB3660': '3.4.5',
    '5217':   '1.5.5',
}

# Models with NO fix available
NO_FIX_MODELS = ['5000', '5100', 'W5108', 'W5208']

def parse_version(v):
    """Parse version string into tuple of ints for comparison."""
    parts = re.findall(r'\d+', v)
    return tuple(int(p) for p in parts)

def check_device(host, port, use_https):
    scheme = 'https' if use_https else 'http'
    base_url = f"{scheme}://{host}:{port}"
    
    # Try common Moxa MGate info endpoints
    endpoints = [
        '/main.htm',
        '/index.htm',
        '/Overview.htm',
        '/api/v1/device/info',
        '/',
    ]
    
    model = None
    fw_version = None
    
    for ep in endpoints:
        try:
            resp = requests.get(
                f"{base_url}{ep}",
                timeout=10,
                verify=False,
                headers={'User-Agent': 'CVE-2026-86325-Checker/1.0'}
            )
            text = resp.text
            
            # Extract model
            m = re.search(r'(MB3170|MB3270|MB3180|MB3280|MB3480|MB3660|MGate\s*5217|W5108|W5208|5000|5100)', text, re.IGNORECASE)
            if m:
                model = m.group(1).strip().replace('MGate ', '').replace('MGate', '')
            
            # Extract firmware version patterns
            fw = re.search(r'[Ff]irmware\s*[Vv]ersion[:\s]+[Vv]?(\d+\.\d+(?:\.\d+)?)', text)
            if not fw:
                fw = re.search(r'[Vv]ersion[:\s]+[Vv]?(\d+\.\d+(?:\.\d+)?)', text)
            if fw:
                fw_version = fw.group(1)
            
            # Also check Server header
            server = resp.headers.get('Server', '')
            if 'Moxa' in server or 'MoxaHttp' in server:
                sm = re.search(r'[Vv]?(\d+\.\d+(?:\.\d+)?)', server)
                if sm and not fw_version:
                    fw_version = sm.group(1)
            
            if model and fw_version:
                break
                
        except requests.exceptions.RequestException:
            continue
    
    return model, fw_version

def main():
    parser = argparse.ArgumentParser(description='Check for CVE-2026-86325 (Moxa MGate Stack Overflow)')
    parser.add_argument('host', help='MGate device IP or hostname')
    parser.add_argument('--port', type=int, default=80, help='Web interface port (default: 80)')
    parser.add_argument('--https', action='store_true', help='Use HTTPS')
    args = parser.parse_args()
    
    if args.https and args.port == 80:
        args.port = 443
    
    print(f"[*] Checking {args.host}:{args.port} for CVE-2026-86325...")
    
    model, fw_version = check_device(args.host, args.port, args.https)
    
    if not model and not fw_version:
        print("UNKNOWN - Could not identify device model or firmware version.")
        print("    Verify the host is a Moxa MGate device and the web interface is reachable.")
        sys.exit(2)
    
    print(f"[*] Detected model: {model or 'Unknown'}")
    print(f"[*] Detected firmware: {fw_version or 'Unknown'}")
    
    if not fw_version:
        print("UNKNOWN - Could not determine firmware version.")
        sys.exit(2)
    
    # Check for models with no fix
    if model:
        for nf in NO_FIX_MODELS:
            if nf.lower() in model.lower():
                print(f"VULNERABLE - {model} has NO patch available for CVE-2026-86325.")
                print("    Contact Moxa support. Apply compensating controls immediately.")
                sys.exit(1)
    
    # Find the matching fixed version
    fixed_ver = None
    matched_model = None
    if model:
        for key, ver in FIXED_VERSIONS.items():
            if key.lower() in model.lower():
                fixed_ver = ver
                matched_model = key
                break
    
    if not fixed_ver:
        # Try all fixed versions and find closest match
        print(f"UNKNOWN - Model '{model}' not in known affected list.")
        print("    Manually verify against Moxa advisory MPSA-269540.")
        sys.exit(2)
    
    current = parse_version(fw_version)
    fixed = parse_version(fixed_ver)
    
    if current >= fixed:
        print(f"PATCHED - Firmware {fw_version} >= fixed version {fixed_ver} for {matched_model}.")
        sys.exit(0)
    else:
        print(f"VULNERABLE - Firmware {fw_version} < fixed version {fixed_ver} for {matched_model}.")
        print(f"    Update to firmware >= {fixed_ver} to remediate CVE-2026-86325.")
        sys.exit(1)

if __name__ == '__main__':
    main()