{"uuid": "a0acc4f6-0552-48a5-920e-a93fcb140520", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16232", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/misc/checkpoint_smartconsole_cve_2026_16232_rce.rb", "content": "{\"aliases\": [], \"arch\": \"python, cmd\", \"author\": [\"sfewer-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits CVE-2026-16232, an authentication bypass in the\\n          Check Point SmartConsole login process affecting Security Management\\n          Server and Multi-Domain Security Management Server. A vulnerable\\n          management server accepts a client-supplied SIC distinguished name\\n          during an application certificate bind instead of binding the\\n          application identity to the authenticated peer certificate.\\n\\n          The module uses the unauthenticated FWM/CPMI service to replay the\\n          management server's own SIC DN, mints a SmartConsole SSO ticket, and\\n          redeems it over the CPM SOAP service. The resulting administrative\\n          session is then used to submit a local one-time run-script command.\\n\\n          Affected versions include R82.10 before Jumbo Hotfix Take 36, R82\\n          before Jumbo Hotfix Take 118, and R81.20 before Jumbo Hotfix Take 158.\\n          Older supported release families are also affected according to the\\n          vendor advisory. Exploitation requires network access to the\\n          management server (Specifically the FWM/CPMI service port on TCP\\n          18190, and the CPM/DLE service port on TCP 19009), and a Trusted\\n          Clients configuration that does not restrict GUI clients.\\n\\n          This module has been successfully tested against vulnerable R82.10\\n          and R81.20 targets.\", \"disclosure_date\": \"2026-07-22\", \"fullname\": \"exploit/linux/misc/checkpoint_smartconsole_cve_2026_16232_rce\", \"is_install_path\": true, \"mod_time\": \"2026-08-25 17:38:56 +0000\", \"name\": \"Check Point SmartConsole Authentication Bypass Run Script RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/misc/checkpoint_smartconsole_cve_2026_16232_rce.rb\", \"platform\": \"Python,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/misc/checkpoint_smartconsole_cve_2026_16232_rce\", \"references\": [\"CVE-2026-16232\", \"URL-https://github.com/sfewer-r7/CVE-2026-16232\", \"URL-https://support.checkpoint.com/results/sk/sk185169/\", \"URL-https://www.rapid7.com/blog/post/ra-check-point-smartconsole-authentication-bypass-technical-analysis-cve-2026-16232/\"], \"rport\": 19009, \"session_types\": false, \"targets\": [\"Python Payloads\", \"Command Payloads\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:15.242172Z"}