Quantum Security Management vulnerabilities
8 known vulnerabilities in Quantum Security Management from Check Point. 8 are rated high or critical, and 3 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.8 High severity
Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Exploited
The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root.
- 7.3 High severity
Quantum Security Gateway: Improper Privilege Management
An input and authorization validation vulnerability in Gaia Portal backend handlers could allow an authenticated, non-administrative user to perform privileged operations that should be restricted to administrators.
- 9.8 Critical severity
Check Point Multiple Products Path Traversal Exploited
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.
- 9.8 Critical severity
Quantum Security Gateway: Heap-based Buffer Overflow
A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems.
- 7.5 High severity
Quantum Security Gateway: Improper Privilege Management
A vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges to execute commands with root privileges.
- 9.1 Critical severity
Quantum Security Management: Improper Authentication
An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an unauthenticated remote attacker to execute administrative commands on the Management Server. Successful exploitation may also allow command
- 9.8 Critical severity
Check Point SmartConsole Improper Authentication Exploited
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows t
- 8.0 High severity
ClusterXL, Multi-Domain Security Management…: Improper Control of Dynamically-Identified Variables
Authenticated Gaia users can inject code or commands by global variables through special HTTP requests. A Security fix that mitigates this vulnerability is available.