authentication bypass vulnerability in the Check Point SmartConsole login process

In plain English

An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers. The official description indicates that exploitation does not require prior authentication. An authentication bypass can allow protected functionality to be reached without completing the intended identity checks.

Vulnerable items

• Quantum Security Management — Quantum Security Management is a Check Point management component used to administer connected systems or services.
• Multi-Domain Security Management — Multi-Domain Security Management is a Check Point management component used to administer connected systems or services.

Recommended action

Temporary workaround: Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. No fixed release is recorded in the parsed advisory, so treat these controls as temporary until the vendor confirms a patched release.