Check Point Patches Management and Log Servers Against Pre-Auth Root Flaw

En bref

• No CVE ID was assigned, and the vendor classifies the issue as medium severity.
• The flaw is reachable over the network and requires no credentials.
• Successful exploitation could grant root-level code execution and rule over firewall policy.
• Check Point has issued patches delivered through LivePatch.

Check Point has addressed a security weakness that affects its Security Management Server and Log Server deployments. According to the vendor, the issue can be reached across a network by parties who have not logged in, and successful abuse could allow code to run with the highest privileges on the affected system. That level of access could also let an intruder change firewall rules and related policy settings, turning a management-plane bug into a broader network risk.

Organizations that run these products—especially government, education, and other entities with sensitive internal networks—should treat management infrastructure as high value. If an adversary can control policy or execute commands as root, they may be able to weaken segmentation, create permissive rules, or disable protections. The vendor rates the problem as medium, but the potential blast radius depends heavily on how exposed the management interfaces are.

A fix from Check Point is now out, and LivePatch provides a way to apply it. No CVE identifier has been published for this issue, which may complicate tracking in vulnerability scanners and ticketing systems. Administrators should therefore verify their version and patch level directly with the vendor's guidance rather than waiting for a CVE-based alert.

Because the attack surface is network-facing and does not require authentication, reducing exposure is urgent. Put management and log services behind strict access controls, confirm that LivePatch updates have actually installed, and review recent configuration and policy changes for anything unexplained. Watch for vendor updates, scanner support, and any signs of attempted or successful exploitation in authentication and system logs.

À faire maintenant

1. Inventory all Check Point Security Management Server and Log Server instances, then confirm which are reachable from untrusted networks.
2. Apply the vendor fix immediately; where LivePatch is available, use it and verify the update completed on every node.
3. Restrict management and log interfaces to dedicated admin VLANs, VPN, or jump hosts, and block public or broad internal access.
4. Review firewall policy, administrator accounts, and configuration changes for unauthorized edits; revert anything unexpected.
5. Hunt logs for unauthenticated access attempts, unusual root-level processes, new admin users, or policy modifications.
6. If compromise is suspected, isolate affected systems, rotate credentials and certificates, and rebuild from trusted media if needed.
7. Track vendor advisories for a CVE assignment and update vulnerability management exceptions accordingly.

Source originale

The Hacker News