CVE-2025-8304
Information Disclosure in Check Point Identity Agent via Registry Access
Publication date: 2025-12-22
Last updated on: 2025-12-22
Assigner: Check Point Software Technologies Ltd.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| checkpoint | identity_agent | 3.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability allows an authenticated local user on a Terminal Server to access sensitive information stored in the Windows Registry keys used by the Check Point Identity Agent. This information can be used to claim security policy rules of another user, potentially leading to unauthorized access or actions.
How can this vulnerability impact me? :
The impact of this vulnerability is that an authenticated local user could gain access to security policy rules belonging to another user, which may lead to unauthorized access or privilege escalation within the system. This could compromise the security of the affected environment.