Check Point Gaia Operating System (sk185152)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(330619);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/30");

  script_cve_id("CVE-2026-62144");
  script_xref(name:"IAVA", value:"2026-A-0768");

  script_name(english:"Check Point Gaia Operating System (sk185152)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"The remote host is missing a hotfix for the Gaia Operating System. It is, therefore, affected
by a vulnerability as referenced in the sk185152 advisory.

  - An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security
    Management allows an unauthenticated remote attacker to execute administrative commands on the Management
    Server. Successful exploitation may also allow command execution on managed Security Gateways.
    Exploitation requires network access to the Management Server without firewall protection or a
    configuration that does not restrict Trusted Clients. (CVE-2026-62144)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://support.checkpoint.com/results/sk/sk185152");
  script_set_attribute(attribute:"solution", value:
"Apply the relevant patch referenced in the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-62144");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/29");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:check_point:gaia_os");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Firewalls");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("check_point_gaia_os_version.nbin");
  script_require_keys("Host/Check_Point/version", "Host/Check_Point/installed_hotfixes", "Settings/ParanoidReport");

  exit(0);
}

if (report_paranoia < 2) audit(AUDIT_PARANOID);

var app_name = 'Gaia Operating System';
var version  = get_kb_item_or_exit('Host/Check_Point/version');
var hfs      = get_kb_item_or_exit('Host/Check_Point/installed_hotfixes');
var vuln     = FALSE;

if ((version == 'R80.20') || (version == 'R80.30') || (version == 'R80.40') ||
    (version == 'R81') || (version == 'R81.10') || (version == 'R81.20') ||
    (version == 'R82') || (version == 'R82.00') || (version == 'R82.10')
  )
{
  if ('sk185152' >!< hfs)
    vuln = TRUE;
}
else
  audit(AUDIT_DEVICE_NOT_VULN, 'The remote device running ' + app_name + ' (version ' + version + ')');

if (vuln)
{
  var report =
    '\n  Installed version      : ' + version +
    '\n  Hotfix required        : Hotfix sk185152' +
    '\n';
  security_report_v4(port:0, severity:SECURITY_HOLE, extra:report);
}
else audit(AUDIT_DEVICE_NOT_VULN, 'The remote device running ' + app_name + ' (version ' + version + ')');