Gaia Os
Monthly
Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during VPN negotiation, letting a remote unauthenticated attacker run arbitrary code on the gateway itself. The CWE-295 root cause means the gateway accepts or mishandles an untrusted/forged certificate in the IKE/SSL-VPN handshake, and processing that malicious certificate leads to code execution rather than merely a trust bypass. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
In rare scenarios, the cpca process on the Security Management Server / Domain Management Server may exit unexpectedly, creating a core dump file. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authenticated Gaia users can inject code or commands by global variables through special HTTP requests. Rated high severity (CVSS 8.0), this vulnerability is low attack complexity. No vendor patch available.
The OSPF implementation in Check Point Gaia OS R75.X and R76 and IPSO OS 6.2 R75.X and R76 does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA). Rated medium severity (CVSS 5.4). No vendor patch available.
Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during VPN negotiation, letting a remote unauthenticated attacker run arbitrary code on the gateway itself. The CWE-295 root cause means the gateway accepts or mishandles an untrusted/forged certificate in the IKE/SSL-VPN handshake, and processing that malicious certificate leads to code execution rather than merely a trust bypass. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
In rare scenarios, the cpca process on the Security Management Server / Domain Management Server may exit unexpectedly, creating a core dump file. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authenticated Gaia users can inject code or commands by global variables through special HTTP requests. Rated high severity (CVSS 8.0), this vulnerability is low attack complexity. No vendor patch available.
The OSPF implementation in Check Point Gaia OS R75.X and R76 and IPSO OS 6.2 R75.X and R76 does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA). Rated medium severity (CVSS 5.4). No vendor patch available.