Authentication Bypass in Check Point SmartConsole

Executive Summary

This is an authentication bypass vulnerability in Check Point SmartConsole that lets unauthenticated remote attackers obtain a login token and gain full admin privileges. It affects the Security Management Server and Multi-Domain Security Management Server.

Useful 0 Not Useful 0

Detection Guidance

Check SmartConsole logs for events involving known attacker IP addresses (151.241.99.207, 151.241.99.233, 158.62.198.182, 192.142.10.99, 139.28.37.250) or authentication via application token.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to modify security policies, change configurations, and gain full administrative control over the affected Check Point systems. Successful exploitation requires internet access to the Management Server and no Trusted Clients restrictions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated attackers to gain full administrative access to security management systems, potentially compromising data integrity and confidentiality. Such unauthorized access could violate compliance requirements under GDPR and HIPAA by enabling unauthorized data access, modification, or exfiltration. Organizations using affected Check Point products may face compliance violations if the vulnerability is exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Limit Trusted Clients to trusted IP addresses or subnets and protect management access with a firewall. Apply the latest Jumbo Hotfix Accumulators for affected versions (R82.10 Take 36+, R82 Take 118+, R81.20 Take 158+).

Useful 0 Not Useful 0