9.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Exploitability: 3.9 / Impact: 4.7
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
Description
A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.
Affected (73)
Products: Checkpoint: Gaia Os, Gaia Embedded
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| From r80.40 to r81.20 |
Configuration B
| Vulnerable Software | Affected Versions |
|---|---|
| From r80.20.00 to r81.10.17 |
| Running on/with | Platform Versions |
|---|---|
Checkpoint Quantum Spark 1530 | All versions |
Checkpoint Quantum Spark 1550 | All versions |
Checkpoint Quantum Spark 1570 | All versions |
Checkpoint Quantum Spark 1570r | All versions |
Checkpoint Quantum Spark 1590 | All versions |
Checkpoint Quantum Spark 1595r | All versions |
Checkpoint Quantum Spark 1600 | All versions |
Checkpoint Quantum Spark 1800 | All versions |
Checkpoint Quantum Spark 1900 | All versions |
Checkpoint Quantum Spark 2000 | All versions |
Configuration C
| Vulnerable Software | Affected Versions |
|---|---|
| From r80.20.00 to r82.00.10 |
| Running on/with | Platform Versions |
|---|---|
Checkpoint Quantum Spark 1535 | All versions |
Checkpoint Quantum Spark 1555 | All versions |
Checkpoint Quantum Spark 1575 | All versions |
Checkpoint Quantum Spark 1575r | All versions |
Checkpoint Quantum Spark 2530 | All versions |
Checkpoint Quantum Spark 2550 | All versions |
Checkpoint Quantum Spark 2560 | All versions |
Checkpoint Quantum Spark 2570 | All versions |
Checkpoint Quantum Spark 2580 | All versions |
Checkpoint Quantum Spark 2590 | All versions |
References (3)
Source: cve@checkpoint.com
MitigationPatchVendor Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Vendor Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
US Government Resource
Timeline
No history available yet.