# FIXTURE_ONLY test table: want_rc|args|expected substring (shared by the bash and Pester tests; args split on spaces)
0|--version R82.20 --take 14|PATCHED: input (gateway, R82.20 Take 14): Jumbo Take 14 is at or above Take 14, the first R82.20 Take with the fix (sk1000362). Confirm ls -l /tmp/dynamic_socket shows srw-rw---- root config (0660) and still hunt: patching does not remove an implant.
0|--version R82.10 --take 52|PATCHED: input (gateway, R82.10 Take 52)
0|--version R82 --take 132|PATCHED: input (gateway, R82 Take 132)
0|--version R81.20 --take 174|PATCHED: input (gateway, R81.20 Take 174)
0|--version r82.20 --take 0099|PATCHED: input (gateway, r82.20 Take 0099): Jumbo Take 99 is at or above Take 14
0|--version R82.10 --take 60 --product management --name FIXTURE_ONLY-m1|PATCHED: FIXTURE_ONLY-m1 (management, R82.10 Take 60)
0|--inventory $F/inv_patched.csv|RESULT: PATCHED (5 checked: 4 PATCHED, 1 NOT AFFECTED, 0 VULNERABLE, 0 NO FIX, 0 UNKNOWN; 0 IOC review item(s))
0|--inventory $F/inv_patched.csv|NOT AFFECTED: FIXTURE_ONLY-sp01 (spark, R82.00 Take 0): sk1000362 lists Check Point Spark Firewalls and Smart-1 Cloud as non-affected products. Spark Firewalls are affected by PHP2Shell (sk1000302); check that separately.
0|--inventory $F/inv_notaffected.csv|RESULT: NOT AFFECTED (2 checked: 0 PATCHED, 2 NOT AFFECTED, 0 VULNERABLE, 0 NO FIX, 0 UNKNOWN; 0 IOC review item(s))
0|--version R82 --take 0 --product spark|NOT AFFECTED: input (spark, R82 Take 0)
0|--cpinfo $F/cpinfo_r8210_t52.txt|PATCHED: input (gateway, R82.10 Take 52)
0|--cpinfo $F/cpinfo_r8210_t52.txt --name FIXTURE_ONLY-c1 --product orchestrator|PATCHED: FIXTURE_ONLY-c1 (maestro orchestrator, R82.10 Take 52)
0|--version R82.20 --take 14 --review $F/review_clean.txt|RESULT: PATCHED (1 checked: 1 PATCHED, 0 NOT AFFECTED, 0 VULNERABLE, 0 NO FIX, 0 UNKNOWN; 0 IOC review item(s))
0|--version R82.20 --take 14 --review $F/review_clean.txt|INFO: tests/fixtures/review_clean.txt: /tmp/dynamic_socket is srw-rw---- root config (0660), the fixed state described in sk1000362 (1 line: 2).
1|--version R82.20 --take 13|VULNERABLE: input (gateway, R82.20 Take 13): below Jumbo Take 14, the first R82.20 Take with the fix (sk1000362). Install Take 14 or later; until then apply the sk1000362 mitigation.
1|--version R82.20 --take 11|VULNERABLE: input (gateway, R82.20 Take 11)
1|--version R82.10 --take 51|VULNERABLE: input (gateway, R82.10 Take 51)
1|--version R82 --take 131|VULNERABLE: input (gateway, R82 Take 131)
1|--version R82 --take 0|VULNERABLE: input (gateway, R82 Take 0)
1|--version R81.20 --take 173|VULNERABLE: input (gateway, R81.20 Take 173): below Jumbo Take 174, the first R81.20 Take with the fix (sk1000362). Install Take 174 or later; until then apply the sk1000362 mitigation. Take 174 was not on Check Point's R81.20 Jumbo resolved issues page when read 12 Nov 2026 17:09 GMT (latest listed: Take 173, 12 Oct 2026); apply the sk1000362 mitigation until you can install it.
1|--version R82.10 --take 50 --product mdls|VULNERABLE: input (mdls, R82.10 Take 50)
4|--version R82.10 --take 50 --product log server|Usage:
1|--cpinfo $F/cpinfo_r8120_t173.txt|VULNERABLE: input (gateway, R81.20 Take 173)
1|--inventory $F/inv_mixed.csv|RESULT: VULNERABLE (5 checked: 1 PATCHED, 1 NOT AFFECTED, 1 VULNERABLE, 1 NO FIX, 1 UNKNOWN; 0 IOC review item(s))
1|--inventory $F/inv_crlf.csv|VULNERABLE: FIXTURE_ONLY-gw50 (maestro orchestrator, R82 Take 131)
1|--inventory $F/inv_crlf.csv|PATCHED: FIXTURE_ONLY-gw51 (mdls, r82.20 Take 014): Jumbo Take 14 is at or above Take 14
1|--review $F/socket_0777.txt|VULNERABLE: tests/fixtures/socket_0777.txt /tmp/dynamic_socket (1 line: 2): srwxrwxrwx (0777), the affected state described in sk1000362. Patch or apply the sk1000362 mitigation.
1|--version R82.20 --take 14 --review $F/socket_0777.txt|RESULT: VULNERABLE (2 checked: 1 PATCHED, 0 NOT AFFECTED, 1 VULNERABLE, 0 NO FIX, 0 UNKNOWN; 0 IOC review item(s))
2|--version R81.10 --take 999|NO FIX: input (gateway, R81.10 Take 999): R81.10 is affected (sk1000362) and has no fixed Jumbo Take (end of support). Apply the sk1000362 mitigation now (stop dynamic_server and prevent restart) and upgrade to a fixed version.
2|--version R81|NO FIX: input (gateway, R81)
2|--cpinfo $F/cpinfo_r81_10.txt|NO FIX: input (gateway, R81.10 Take 999)
2|--inventory $F/inv_nofix.csv|RESULT: NO FIX (2 checked: 1 PATCHED, 0 NOT AFFECTED, 0 VULNERABLE, 1 NO FIX, 0 UNKNOWN; 0 IOC review item(s))
3|--version R82.10|UNKNOWN: input (gateway, R82.10): no Jumbo Take given. R82.10 is fixed from Take 52 (sk1000362).
3|--version R80.40 --take 999|UNKNOWN: input (gateway, R80.40 Take 999): R80.40 is not listed in sk1000362 (affected: R82.20, R82.10, R82, R81.20, R81.10, R81). Check with Check Point.
3|--version R82.30 --take 1|UNKNOWN: input (gateway, R82.30 Take 1): R82.30 is not listed in sk1000362
3|--version 82.10 --take 52|UNKNOWN: input (gateway, 82.10 Take 52): not a Gaia version this pack can judge (use the form R82.10).
3|--version R82.10 --take T52|UNKNOWN: input (gateway, R82.10 Take T52): Jumbo Take must be a number (0 if none).
3|--version R82.10 --take 52 --product endpoint|UNKNOWN: input (endpoint, R82.10 Take 52): product not named in sk1000362 (affected: Force Firewalls, Management and Log Servers, Multi-Domain Security Management and Multi-Domain Log Server, Maestro Orchestrator).
3|--inventory $F/inv_unknown.csv|RESULT: UNKNOWN (6 checked: 0 PATCHED, 0 NOT AFFECTED, 0 VULNERABLE, 0 NO FIX, 6 UNKNOWN; 0 IOC review item(s))
3|--inventory $F/inv_unknown.csv|UNKNOWN: FIXTURE_ONLY-gw35 (no product, R82.10 Take 52): no product given.
3|--cpinfo $F/cpinfo_nojumbo.txt|UNKNOWN: input (gateway, R82): no HOTFIX_R82_JUMBO_HF Take line in the cpinfo output (format from sk83860; the _MAIN suffix seen on newer versions is UNVERIFIED). Confirm the Take by hand.
3|--cpinfo $F/cpinfo_two_takes.txt|UNKNOWN: input (gateway, R82): cpinfo shows more than one Jumbo Take (130 132). Confirm by hand.
3|--cpinfo $F/cpinfo_noversion.txt|UNKNOWN: input (gateway, cpinfo tests/fixtures/cpinfo_noversion.txt): no single "software version Rxx - Build" line found (format from sk83860). Enter --version and --take by hand.
3|--cpinfo $F/cpinfo_otherjumbo.txt|UNKNOWN: input (gateway, R82.20): no HOTFIX_R82_20_JUMBO_HF Take line
3|--review $F/review_clean.txt|RESULT: UNKNOWN (0 checked: 0 PATCHED, 0 NOT AFFECTED, 0 VULNERABLE, 0 NO FIX, 0 UNKNOWN; 0 IOC review item(s))
3|--review $F/review_empty.txt|REVIEW tests/fixtures/review_empty.txt: 1 lines read.
3|--review $F/socket_other.txt|INFO: tests/fixtures/socket_other.txt: /tmp/dynamic_socket permissions or owner not described in sk1000362; check by hand (2 lines: 2,3).
3|--review $F/review_clean.txt|INFO: tests/fixtures/review_clean.txt: 1 segfault line(s) naming httpd or php, below our threshold of 10 (1 line: 11).
4||Usage:
4|--version|Usage:
4|--take 52|Usage:
4|--version R82 --take 132 --inventory $F/inv_patched.csv|Usage:
4|--version R82 --take 132 --cpinfo $F/cpinfo_r8210_t52.txt|Usage:
4|--inventory $F/inv_patched.csv --name x|Usage:
4|--review $F/review_clean.txt --product gateway|Usage:
4|--bogus 1|Usage:
4|--inventory $F/inv_bad_header.csv|ERROR: CSV header must be: name,product,version,take
4|--inventory $F/inv_header_only.csv|ERROR: inventory has no data rows: tests/fixtures/inv_header_only.csv
4|--inventory $F/missing.csv|ERROR: cannot read inventory file: tests/fixtures/missing.csv
4|--cpinfo $F/missing.txt|ERROR: cannot read cpinfo file: tests/fixtures/missing.txt
4|--review $F/missing.log|ERROR: cannot read review file: tests/fixtures/missing.log
5|--review $F/review_iocs.txt|RESULT: IOC REVIEW (0 checked: 0 PATCHED, 0 NOT AFFECTED, 0 VULNERABLE, 0 NO FIX, 0 UNKNOWN; 20 IOC review item(s))
5|--review $F/review_iocs.txt|IOC REVIEW: tests/fixtures/review_iocs.txt: webshell template zz*.tpl (CPR) (1 line: 2).
5|--review $F/review_iocs.txt|IOC REVIEW: tests/fixtures/review_iocs.txt: SHA-256 from the Check Point Research IOC list (1 line: 18).
5|--review $F/review_iocs.txt|IOC REVIEW: tests/fixtures/review_iocs.txt: dynamicCli.log "Received =" without the standard Clish wrapper (sk1000362) (2 lines: 12,13).
5|--review $F/review_iocs.txt|IOC REVIEW: tests/fixtures/review_iocs.txt: /tmp/des wiper path (CPR) (1 line: 19).
5|--review $F/review_iocs.txt|IOC REVIEW: tests/fixtures/review_iocs.txt: TCP 11072 listener (CPR, TSGA; listing format UNVERIFIED) (1 line: 11).
5|--review $F/review_iocs.txt|IOC REVIEW: tests/fixtures/review_iocs.txt: OUR PATTERN, SSH activity naming vpxuser (CPR: lateral movement to ESXi as vpxuser; ESXi log format UNVERIFIED) (1 line: 22).
5|--review $F/segv_burst.log|IOC REVIEW: tests/fixtures/segv_burst.log: OUR PATTERN, 12 segfault lines naming httpd or php (CPR reports hundreds during exploitation; message format UNVERIFIED) (12 lines: 2,3,4,5,6,...).
5|--inventory $F/inv_mixed.csv --review $F/review_iocs.txt|RESULT: IOC REVIEW (5 checked: 1 PATCHED, 1 NOT AFFECTED, 1 VULNERABLE, 1 NO FIX, 1 UNKNOWN; 20 IOC review item(s))
5|--version R82.20 --take 14 --review $F/review_clean.txt --review $F/segv_burst.log|RESULT: IOC REVIEW (1 checked: 1 PATCHED
