206 matches found
Local Privilege Escalation in Check Point Endpoint Security Remediation Service
Symptoms - This vulnerability allows local attackers to escalate privileges on affected installations of Check Point Harmony Endpoint / ZoneAlarm Extreme Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability...
Check Point Response to CVE-2023-28130 - Hostname command injection in Gaia Portal
Symptoms - Local user may lead to privilege escalation using Gaia Portal "Hosts and DNS" page. This issue received the ID CVE-2023-28130. Solution This problem was fixed. The fix adds more validations on user input and is included starting from: Check Point R82 Jumbo Hotfix Accumulator for R81.20...
Check Point response to TLS 1.x padding vulnerability
...
HTTPS Inspection update for attending India CCA unauthorized digital certificates
...
Anti-Spoofing might be enforced incorrectly in specific scenarios on R75.47 Security Gateway
...
Check Point response to Vulnerabilities in Visual Studio Active Template Library (MS09-035)
...
Check Point response to OpenSSL vulnerability CVE-2007-5135
...
CVE-2026-16232 - Authentication bypass with SmartConsole login process using application token
Symptoms - Impact: An unauthenticated attacker can obtain an application login token and use it to login via SmartConsole with full admin privileges and apply changes to the security policy and security configuration. Check Point is aware that this vulnerability is being exploited, impacting a ve...
Check Point Response to CVE-2025-9142 - Harmony SASE Windows Client Vulnerability
Cause The authentication and file-handling logic does not enforce strict trust boundaries. Under specific conditions, the system fails to validate data during certificate processing before using it in a privileged service component. Symptoms - A local attacker can trigger Harmony SASE Windows...
CVE-2024-52887 - Self-XSS vulnerability in Mobile Access Native Applications 'favorites' dialog
Symptoms - The Mobile Access portal is vulnerable to a stored, self-XSS attack. An authenticated end-user may set a specially crafted SNX bookmark that can make their browser run a script while accessing their own bookmark list. So far today, no attack with actual impact is known. - This issue...
Check Point Response to Docker Desktop Vulnerabilities
Solution This article provides Check Point response to Docker Desktop vulnerabilities that various vulnerability scanners may show when testing a Check Point Security Gateway / Management Server / Log Server. To exploit a Docker Desktop vulnerability, a malicious actor must have a local access on...
VPN SNX portal may be vulnerable to brute-force attack on passwords
Cause The VPN SNX portal in the IPsec VPN Software Blade does not implement any protection against brute-force attack on usernames/passwords. Symptoms - The IPsec VPN blade has a dedicated portal for downloading and connecting through SSL Network Extender SNX. If the portal is configured for...
Check Point Response to SNIcat
...
Check Point CloudGuard Controller fails to connect to a VMware vCenter Data Center in R80.20.M2
...
Rare failure in the Identity Sharing network registration may potentially result in incorrect policy actions
Cause The connection is handled by the PEP Gateway, but no identity is found on the PEP for the connectionÂ’s IPs. With smart pull Identity sharing, the PEP Gateway will hold the connection if: 1. The Access Role is used in the policy and required for the final rulebase match. 2. There is a remote...
Check Point's response to PHP Floating-Point Value Denial of Service Vulnerability (CVE-2010-4645)
...
CVE-2024-52888 - Mobile Access File Share applications are vulnerable to stored XSS attacks
Symptoms - When an authenticated Mobile Access portal end-user browses to a File Share application, the portal may run a script while attempting to display a directory or some file's properties. Additionally, an authenticated attacker may store specially crafted file/dir names for other...
Check Point Response to CVE-2024-24914 - TCL substitution of global parameter values
Symptoms - After logging in to Gaia Portal, authenticated users local Gaia users and RADIUS / TACACS users may cause code injection in Gaia Portal because of unprotected global variables usage when processing the HTTP request in the TCL process. This issue received the ID CVE-2024-24914. Solution...
Check Point Response to CVE-2024-24912 - local privilege escalation in Harmony Endpoint Security Client for Windows via crafted DLL file
Symptoms - A local privilege escalation vulnerability has been identified in Harmony Endpoint Security Client for Windows versions E88.10 and lower. By manipulating the COM object, an attacker could load a specially crafted DLL. An attacker must first obtain the ability to execute local privilege...
Check Point Response to CVE-2023-28133 - Local privilege escalation in Check Point Endpoint Security Client via crafted OpenSSL configuration file
Symptoms - Local privilege escalation in Check Point Endpoint Security Client. Affected versions: E87.30 and lower, including all E86.x clients. Affected clients: Standalone Remote Access VPN clients, Endpoint Security Clients with Remote Access VPN enabled. Affected processes: TracSrvWrapper.exe...
RADIUS/TACACS+ users fail to change the default admin password when running the First Time Wizard
...
Detection issue of malicious URLs in Anti-Bot / Anti-Virus after installing Take 143 of R77.30 Jumbo Hotfix Accumulator
...
Important security and stability enhancements for Security Gateway
...
Endpoint Security MI Server R73 certificate validation
...
E-mails might not be scanned by the Threat Emulation blade in some specific scenarios depending on the e-mail client behavior
...
CVE-2024-24915 - Potential vulnerability in SmartConsole where an administrator's credentials may be exposed to users with debugging privileges on the administrator's computer
Symptoms - Credentials are not cleared from memory after being used. A user with Administrator permissions can execute a memory dump for the SmartConsole process and fetch them. - This issue received the ID CVE-2024-24915. Solution This problem was fixed. The fix is included starting from: R82...
Check Point Response to CVE-2024-3596 - Blast-RADIUS attack
Cause The Blast-RADIUS attack allows a man-in-the-middle attacker between the RADIUS client and server to forge a valid protocol accept message in response to a failed authentication request. This forgery could give the attacker access to network devices and services without the attacker guessing...
Check Point Response to CVE-2021-30356 - denial-of-service vulnerability in Identity Agent
Cause A denial-of-service vulnerability was reported in Check Point Identity Agent before R81.018.0000, which could allow low privileged users to overwrite protected system files. This issue was published as CVE-2021-30356. The write-up for the vulnerability is available at:...
Few Remote Access clients that do not support Multi-Factor Authentication (MFA) are able to connect to a Security Gateway even though "Allow older clients" is disabled
...
In a rare scenario, R80.30 Security Gateway managed by R80.30 Security Management crashes when Threat Prevention Forensics feature is enabled
...
R77.30, R77.20 Security hotfix for DLP and Threat Extraction blades
...
Mail Transfer Agent (MTA) protection bypass
...
Check Point response to ZoneAlarm DLL injection
...
Check Point response to "Check Point Connection Table Leakage"
...
Check Point's Response to Stonesoft's "Advanced Evasion Techniques" (CVE-2010-0102)
...
Endpoint Security Server Information disclosure vulnerability
...
Check Point response to "Jedi Packet Trick" (CVE-2010-0104)
...
Connectra PHP Vulnerability
...
OpenSSH vulnerability - Privilege Separation Monitor Weakness
...
CVE-2026-48133 - Identity Awareness Captive Portal - Unauthenticated Local File Inclusion
Symptoms - When the Identity Awareness blade is enabled with Browser-Based Authentication, an unauthenticated user may be able to read certain internal files on the Security Gateway. - This issue affects: R82.10 with Jumbo Hotfix Take 6 or below R82 with Jumbo Hotfix Take 91 or below R81.20 with...
Check Point Response to CVE-2024-24916 - DLL HiJacking
Cause The installer relies on the default Windows DLL search order, which includes the current working directory. If required DLLs are missing or not explicitly loaded from a secure path, this can lead to DLL hijacking. Symptoms - Untrusted DLLs in the installer's directory may be loaded and...
Check Point Response to CVE-2024-24911 - Out of Bounds read in the CPCA process on a Check Point Management Server
Cause An Out-of-Bounds read may occur when processing certain HTTP "POST" requests to the Security Management Server / Domain Management Server to the TCP port 18264. Repeated requests can cause a denial-of-service DoS of the cpca process and may lead it to exit unexpectedly with a core dump file...
Authenticating to SMB appliances using only the first 8 characters of the Administrator password is allowed
...
Check Point response to Bleichenbacher oracle cryptographic attack (IKEv1/IKEv2)
...
Using Domain Objects in the rulebase might cause wrong policy actions in R80.10 JHF Take_91-103
...
Some protections may not work for specific HTTP evasions in R77.10 / R77 / R76
...
Security Gateway Virtual Edition (VE) VMWare OVF template security update
...
When using Threat Emulation to scan mail content, some files encoded in MIME may be incorrectly decoded causing a 'False-Negative' result of the emulated file
...