Scans the SMS global Remote Access VPN property:

If the current value is not ike_v2_only, the app can approve and apply a change to set the property to:

This scan is intended to identify exposure where deprecated IKEv1 key exchange is still globally allowed for VPN Remote Access and Mobile Access. IKEv1 is deprecated and no longer industry best practice. This change can affect older VPN clients. Review SK166415 for additional Check Point guidance.

Legacy Client's Allowed Check Scan and Mitigate (CVE-2026-50751)

Scans simple gateways and checks each gateway generic object for the VPN realm inside:

The app reports whether legacy clients are supported or disabled. When mitigation is approved, it sets the VPN realm owned-object disabled value to true.

User-facing result text:

• Legacy clients are disabled
• Legacy Clients are Supported

Allowing legacy clients can preserve support for IKEv1, which is no longer an industry best practice. We recommend disabling this setting unless legacy clients are still required. If legacy clients are needed, plan to migrate them to a more secure modern VPN client.

User Personal Certificate Check (CVE-2026-85102/85103)

This check looks for personal certificate authentication as a configuration marker for the certificate-validation issue described in the app: improper validation of certificate data during VPN negotiation may allow an unauthenticated remote attacker to execute arbitrary code on the gateway.

For each simple gateway returned in the scanned management domain, the app requests full details using show-simple-gateway. The equivalent CLI inspection is:

It inspects vpn-settings.authentication.authentication-clients, including each client's nested authentication-methods array, for:

Detection uses the authentication factor, not a hard-coded client name. The evidence table displays the gateway, domain, UID, current state, matching client display names, and status. Missing or incomplete details show as Unknown; API failures show as Scan error. Neither is treated as a clean result. This check currently enumerates simple gateways, not cluster objects.

Select the checkbox for each gateway to update, then click Remove User Certificate. The app rechecks the selected gateways and removes the detected personal-certificate login options by their actual object names. For a client named Personal_Certificate, the equivalent command is:

Other authentication-client entries remain in place. Removing a login option removes that entire option, including any additional methods it contains; it does not delete certificate objects. Clients relying on the removed option need another authentication method after policy installation.

Publish after successful apply is checked by default. The app reports individual gateway successes and failures and refreshes the scan afterward. If any gateway update fails, this action does not automatically publish the successful changes; review them before publishing manually. Publishing errors are reported separately. Install policy after publishing.

Site-to-Site VPN Communities Scan and Mitigate (CVE-2026-50752)

Scans both Check Point site-to-site VPN community types:

• Star communities
• Mesh communities

The app flags a VPN community only when all of these are observed:

• VPN site-to-site is enabled.
• The VPN community uses IKEv1.
• Gateways participating in the VPN community use certificate-based authentication.

For Star communities, the app displays center gateways and satellite gateways separately. Gateway names are tagged as locally managed or externally managed when the API data provides enough object type information.

For Mesh communities, the app pulls gateway names from the community gateways list. Mesh communities do not include externally managed gateway handling in this tool, so that field is shown as not applicable.

When mitigation is approved, the app attempts to set the VPN community encryption method to IKEv2 only. Star communities use:

Mesh communities use:

If a selected Star community includes externally managed gateways, the app warns before applying the change. You must make sure the matching IKEv2-only change is also made on the externally managed gateway side.

Configure Explicit Control Connections

Reads firewall.accept-control-connections from show-global-properties with details-level: full. The table shows Enabled, Disabled, Unknown, or Scan error, with management/domain labels and API evidence.

This is a read-only check. Replace implied rules with explicit Access Control rules only in high security environments, following SK179346. Incorrect rules can break policy installation and management/log connectivity. A disabled setting alone does not verify that the required explicit rules exist.

Workflow

1. Select the management host type and log in with a Check Point Management API user or API key.
2. Click Scan Check Point Config.
3. Review the global IKE property, legacy clients, personal certificate authentication, site-to-site VPN communities, and implied control connections.
4. Approve only the changes you want to apply.
5. Click the matching apply button.
6. Publish from the tool or uncheck Publish after successful apply if you want to inspect and publish manually.
7. Install policy after publishing so gateway-side changes take effect.

A live status bar appears at the bottom while operations run. After login, it polls the backend for the latest API command, domain, and number of commands started, and shows elapsed time. The activity indicator is not a percentage-complete estimate.

Security Notes

• The app defaults to HTTPS when connecting to the Check Point management server.
• Do not enter the management server as http://...; that would send the Check Point API login over cleartext HTTP.
• The browser talks to the local backend over http://127.0.0.1:3000.
• The username and password are sent from the browser to the local backend only on localhost.
• The backend sends the username and password to Check Point through the Management API login request.
• Passwords are not logged by the app.
• The Check Point session ID is stored only in server memory for the life of the local Node process.
• The Allow self-signed certificate option keeps TLS encryption but disables certificate validation. Use it only when needed.

API Commands Used

The backend proxies these Check Point Management API commands:

• login
• logout
• publish
• show-session
• show-domains
• show-gateways-and-servers
• show-simple-gateways
• show-simple-gateway
• set-simple-gateway
• show-generic-object
• set-generic-object
• show-global-properties
• set-global-properties
• show-vpn-communities-star
• show-vpn-communities-meshed
• set-vpn-community-star
• set-vpn-community-meshed

Install and Run

This project has no third-party npm dependencies. It only requires Node.js 18 or newer when running from source.

macOS From Source

1. Install Node.js 18 or newer from nodejs.org or Homebrew.

   root@kitploit:~

   brew install node
   

2. Download or clone this project.

   root@kitploit:~

   git clone <repo-url>
   cd CVE-Web-Check
   

3. Start the local app.

   root@kitploit:~

   npm start
   

   Because there are no npm dependencies, this also works:

   root@kitploit:~

   node server.js
   

4. Open the app.

   root@kitploit:~

   http://127.0.0.1:3000
   

Windows From Source

1. Install Node.js 18 or newer from nodejs.org.

2. Download and extract the project ZIP, or clone the repository with Git for Windows.

   root@kitploit:~

   git clone <repo-url>
   cd CVE-Web-Check
   

3. Start the local app.

   root@kitploit:~

   npm start
   

   Because there are no npm dependencies, this also works:

   root@kitploit:~

   node server.js
   

4. Open the app in a browser.

   root@kitploit:~

   http://127.0.0.1:3000
   

Optional Port Change

By default the app listens on 127.0.0.1:3000. To use another port:

macOS:

Windows PowerShell:

Then open:

Troubleshooting

Open the running app at http://127.0.0.1:3000, not by opening public/index.html as a local file. The API calls and live status bar require the Node backend. After a backend restart, log in again and run a fresh scan.

The server prints request diagnostics to the terminal. A successful login attempt will show lines similar to:

If the browser shows a login error with a request ID but packet capture shows no outbound attempt to the management server, compare the terminal target= value with your packet capture filter.

If there is no Local API request line at all, the browser is not reaching the local backend. Confirm the app is running and that you opened the correct local URL.