Threat database

An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and authenticate with full administrative privileges. Exploitation enables modification of security policies and configurations. Remote exploitation requires internet access to the Management Server IP and a configuration that does not restrict Trusted Clients. Check Point is aware of active exploitation affecting a very small number of customers.

Check Point ZoneAlarm Extreme Security Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Check Point ZoneAlarm Extreme Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Forensic Recorder service. By creating a symbolic link, an attacker can abuse the service to overwrite arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-21677.

CVE-2024-24919 is an information disclosure vulnerability in Check Point Quantum Security Gateways and related product lines. It allows attackers to access sensitive information on gateways connected to the internet with IPSec VPN, Remote Access VPN, or Mobile Access enabled. The vulnerability has a high severity score of 8.6 and has been exploited in the wild, including use in ransomware campaigns.