This vulnerability arises from improper authentication (CWE-287) due to a logic flaw in certificate validation during the deprecated IKEv1 key exchange in Check Point Quantum Security Gateway. An attacker can exploit this to bypass user authentication and gain remote VPN access without valid credentials. The affected versions include R82.10 with Jumbo Hotfix Take 19 or below, R82 with Jumbo Hotfix Take 103 or below, R81.20 with Jumbo Hotfix Take 141 or below, and versions R81.10, R81, and R80.40. No patch or remediation information is currently available from the vendor.

An unauthenticated remote attacker can bypass user authentication and establish a remote access VPN connection without a valid user password, potentially gaining unauthorized network access. This could lead to unauthorized access to internal resources protected by the VPN. No known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling deprecated IKEv1 key exchange if possible or restricting VPN access to trusted networks or users as a temporary measure.