Description
A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
Low
Availability
None
Affected products
- checkpoint / gaia_embeddedr82.00.10 – r82.00.10
- checkpoint / gaia_embeddedr82.00.10 – r82.00.10
- checkpoint / gaia_embeddedr82.00.10 – r82.00.10
- checkpoint / gaia_embeddedr82.00.10 – r82.00.10
- checkpoint / gaia_embeddedr82.00.10 – r82.00.10
- checkpoint / gaia_embeddedr80.20.00 – r81.10.17
- checkpoint / gaia_embeddedr81.10.17 – r81.10.17
- checkpoint / gaia_embeddedr81.10.17 – r81.10.17
- checkpoint / gaia_embeddedr81.10.17 – r81.10.17
- checkpoint / gaia_embeddedr81.10.17 – r81.10.17
- checkpoint / gaia_embeddedr81.10.17 – r81.10.17
- checkpoint / gaia_embeddedr81.10.17 – r81.10.17
- checkpoint / gaia_embeddedr82.00.10 – r82.00.10
- checkpoint / gaia_embeddedr82.00.10 – r82.00.10
- checkpoint / gaia_osr81.20 – r81.20
- checkpoint / gaia_osr81.20 – r81.20
- checkpoint / gaia_osr81.20 – r81.20
- checkpoint / gaia_osr81.20 – r81.20
- checkpoint / gaia_osr81.20 – r81.20
- checkpoint / gaia_osr81.20 – r81.20
- checkpoint / gaia_osr81.20 – r81.20
- checkpoint / gaia_osr81.20 – r81.20
- checkpoint / gaia_osr81.20 – r81.20
- checkpoint / gaia_osr81.20 – r81.20
- checkpoint / gaia_osr81.20 – r81.20
- checkpoint / gaia_osr81.20 – r81.20
- checkpoint / gaia_osr81.20 – r81.20
- checkpoint / gaia_osr81.20 – r81.20
- checkpoint / gaia_osr81.20 – r81.20
- checkpoint / gaia_osr81.20 – r81.20
- checkpoint / gaia_osr81.20 – r81.20
- checkpoint / gaia_osr81.20 – r81.20
- checkpoint / gaia_osr81.20 – r81.20
- checkpoint / gaia_osr81.20 – r81.20
- checkpoint / gaia_osr81.20 – r81.20
- checkpoint / gaia_osr81.20 – r81.20
- checkpoint / gaia_osr81.20 – r81.20
- checkpoint / gaia_osr81.20 – r81.20
- checkpoint / gaia_osr82 – r82
- checkpoint / gaia_osr82 – r82
- checkpoint / gaia_osr82 – r82
- checkpoint / gaia_osr82 – r82
- checkpoint / gaia_osr82 – r82
- checkpoint / gaia_osr82 – r82
- checkpoint / gaia_osr82 – r82
- checkpoint / gaia_osr82 – r82
- checkpoint / gaia_osr82 – r82
- checkpoint / gaia_osr82 – r82
- checkpoint / gaia_osr82 – r82
- checkpoint / gaia_osr82 – r82
- checkpoint / gaia_osr82 – r82
- checkpoint / gaia_osr82 – r82
- checkpoint / gaia_osr82 – r82
- checkpoint / gaia_osr82 – r82
- checkpoint / gaia_osr82 – r82
- checkpoint / gaia_osr82.10 – r82.10
- checkpoint / gaia_osr82.10 – r82.10
- checkpoint / gaia_osr82.10 – r82.10
- checkpoint / gaia_osr82 – r82
- checkpoint / gaia_osr80.40 – r81.20
- checkpoint / gaia_osr81.20 – r81.20
- checkpoint / gaia_osr81.20 – r81.20
- checkpoint / gaia_osr81.20 – r81.20
- checkpoint / gaia_osr81.20 – r81.20
- checkpoint / gaia_osr81.20 – r81.20
- checkpoint / gaia_osr81.20 – r81.20
- checkpoint / gaia_osr81.20 – r81.20
- checkpoint / gaia_osr81.20 – r81.20
- checkpoint / gaia_osr81.20 – r81.20
- checkpoint / gaia_osr81.20 – r81.20
- checkpoint / gaia_osr81.20 – r81.20
- checkpoint / gaia_osr81.20 – r81.20
- checkpoint / Quantum Security GatewayR82.10 with Jumbo Hotfix Take 19 or below – R82.10 with Jumbo Hotfix Take 19 or below
- checkpoint / Quantum Security GatewayR81.10, R81, and R80.40 – R81.10, R81, and R80.40
- checkpoint / Quantum Security GatewayR81.20 with Jumbo Hotfix Take 141 or below – R81.20 with Jumbo Hotfix Take 141 or below
- checkpoint / Quantum Security GatewayR82 with Jumbo Hotfix Take 103 or below – R82 with Jumbo Hotfix Take 103 or below
- checkpoint / Spark FirewallsR80.20.X, R81.10.X, and R82.00.X – R80.20.X, R81.10.X, and R82.00.X
Exploits & proofs of concept
- nucleiCheck Point IKEv1 Remote-Access VPN - Certificate Authentication Bypassby watchTowr,DhiyaneshDk
References
Updated 5m ago · 8 sources