HackSpeak/CVE-2026-16232

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python 3 script that exploits CVE-2026-16232, an authentication bypass in Check Point SmartConsole. It connects to the unauthenticated SIC/CPMI service, reuses the server's own SIC DN to forge an application certificate bind, obtains an application DLE token, mints a SmartConsole SSO ticket via gen-sso-token, and redeems it to gain a full administrative session, demonstrated by enumerating administrators via GetAllAdmins.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python PoC script and a README for CVE-2026-16232, an authentication bypass in Check Point SmartConsole. The script demonstrates the exploit by connecting to the target, forging an application bind, obtaining a token, and escalating to an administrator session. All behavior is consistent with the stated vulnerability and contains no concealed executable payload, credential exfiltration, persistence mechanism, or unrelated remote access. No backdoor or deceptive payload targeting the person running the PoC was observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagespython
Target softwareCheck Point SmartConsoleCheck Point Security Management ServerCheck Point Multi-Domain Security Management Server
Attack typesauthentication bypassprivilege escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete, executable Python script that actively exploits CVE-2026-16232 to bypass authentication and gain full administrative privileges on a Check Point management server. It performs the full attack chain: unauthenticated SIC/CPMI handshake, forged certificate bind, token acquisition, SSO ticket minting, and session redemption to enumerate administrators. The README explicitly describes it as a PoC for an authentication bypass and states it is for security research and vulnerability verification.

CVE-2026-16232.py:1-13CVE-2026-16232.py:373-481README.md:1-3

Requirements

  • Network access to the management server's SIC/CPMI port (default 18190) and CPM SOAP port (default 19009).CVE-2026-16232.py:26-28CVE-2026-16232.py:232CVE-2026-16232.py:304
  • The target management server must not restrict Trusted Clients.CVE-2026-16232.py:1
  • The target must be running a vulnerable version of Check Point management software (e.g., R81.20 with Jumbo Hotfix Take 158 or below).README.md:13

Observed behavior

  • Connects to the target's FWM port, performs an unauthenticated SIC/CPMI handshake, and retrieves the management server's SIC DN.CVE-2026-16232.py:229-238
  • Sends a client_set command presenting as an application client (SmartView Reporter Client) without administrator privileges.CVE-2026-16232.py:393
  • Sends a certificate_bind command with the server's own SIC DN in the :DN field, exploiting the vulnerability to forge an application identity.CVE-2026-16232.py:397-407
  • Sends an open-database command to obtain a DLE application token.CVE-2026-16232.py:415-431
  • Uses the application token to call the protected getServerInfo SOAP API and prints server details.CVE-2026-16232.py:435-439
  • Sends a gen-sso-token command to mint a SmartConsole SSO ticket with full permissions (ffffffff|ffffffff|ffffffff).CVE-2026-16232.py:446-465
  • Redeems the SSO ticket via a loginNew SOAP request to obtain a full administrative DLE session.CVE-2026-16232.py:349-370
  • Calls GetAllAdmins with the administrative session and prints the list of administrators, demonstrating elevated privileges.CVE-2026-16232.py:472-477
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Connection
Target management server on ports 18190 (SIC/CPMI) and 19009 (CPM SOAP)The PoC connects to the user-supplied target to demonstrate the exploit; this is expected behavior for a vulnerability PoC.CVE-2026-16232.py:232CVE-2026-16232.py:304
Authentication Bypass
Reuse of management server SIC DN in certificate_bind to forge application identityThis is the core vulnerability being demonstrated; the script explicitly documents this as the root cause.CVE-2026-16232.py:395-401
Privilege Escalation
Minting and redeeming a SmartConsole SSO ticket with full permissionsThe PoC escalates from an application token to a full administrator session, which is the intended demonstration of impact.CVE-2026-16232.py:446-464
Review boundaries

What the analysis did not establish

  • One file (sha256:sha256:3497d4f1000da12d180c289a4e2164a096f3f9c30ce740291bf098623be28f91) was omitted from the evidence; its content is not available for analysis.
  • The evidence does not include the full repository snapshot; only two of three files are provided.
  • The analysis is based solely on static review of the provided source code; the code was not executed, and its behavior is inferred from the source.
  • One file (unclassified, 1066 bytes) was omitted from the evidence and not analyzed; its content is unknown.
  • Binary analysis was not performed; the artifact contains no identified binary files.
  • The review is limited to static analysis of the supplied text; no dynamic execution was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1