Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated, network-reachable overflow in the VPN certificate parser with no user interaction, yielding code execution on the appliance, so full C/I/A impact.
Primary rating from Vendor (checkpoint).
CVSS VectorVendor: checkpoint
Lifecycle Timeline
3DescriptionCVE.org
A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems.
AnalysisAI
Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based buffer overflow in the ASN.1 decoder that parses VPN certificates, reachable by unauthenticated remote attackers. Because the flaw sits in the certificate-handling path of the internet-facing VPN service, a single crafted certificate or handshake can overflow heap memory and execute attacker-controlled code on security appliances that sit at the network perimeter. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target expose the VPN certificate-handling path - i.e., a Quantum Security Gateway running IKE/VPN services that accept and decode certificates, or a reachable Quantum Security Management instance - to the attacker's network position. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes the worst-case signal set: remote, low-complexity, no authentication, no user interaction, full confidentiality/integrity/availability impact - consistent with a pre-auth overflow in an internet-facing VPN parser. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fix referenced in Check Point advisory sk1000118 (https://support.checkpoint.com/results/sk/sk1000118) - typically delivered as a jumbo hotfix take or version upgrade for the affected Gaia/Quantum releases; the input does not contain an exact fixed version, so treat the SK as the authoritative patch source (Patch available per vendor advisory; exact version not provided in input). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Check Point Quantum Gateway and Management appliances currently deployed, identify which versions are in use, and determine which systems expose VPN endpoints to untrusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Checkpoint
View allGNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attacker
Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during V
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. Rated high sever
Remote code execution in PyTorch Lightning through 2.6.5 allows an attacker who can get a victim to load a malicious che
Check Point Endpoint Security Initial Client for Windows before version E81.30 tries to load a DLL placed in any PATH lo
Same weakness CWE-122 – Heap-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today
EUVD-2026-75010
GHSA-g4cm-76f6-qvmc