CVE-2020-6021

Published: Dec 3, 2020Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

Check Point Endpoint Security Client for Windows before version E84.20 allows write access to the directory from which the installation repair takes place. Since the MS Installer allows regular users to run the repair, an attacker can initiate the installation repair and place a specially crafted DLL in the repair folder which will run with the Endpoint client’s privileges.

Affected (1)

Products: Checkpoint: Endpoint Security

1 product

Endpoint Security

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Checkpoint Endpoint Security	Before e84.20

Related CWEs

Uncontrolled Search Path Element

The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

References (2)

https://supportcontent.checkpoint.com/solutions?id=sk170512

Source: cve@checkpoint.com

Vendor Advisory

https://supportcontent.checkpoint.com/solutions?id=sk170512

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.