PT-2023-8555 · Check Point · Check Point Endpoint Security+2

Published 2023-11-07 · Updated 2024-09-03 · CVE-2023-28134

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Check Point Harmony Endpoint/ZoneAlarm Extreme Security versions (affected versions not specified)

Description The issue is related to improper permission assignment for a critical resource in Check Point Endpoint Security. It allows a local attacker to escalate privileges on affected installations. To exploit this, an attacker must first obtain the ability to execute low-privileged code on the target system. This can lead to the execution of arbitrary code with SYSTEM-level privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

BDU:2024-01162

CVE-2023-28134

ZDI-23-1764

Affected Products

Check Point Endpoint Security

Check Point Harmony Endpoint

Zonealarm Extreme Security

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-28134 · Security Note
• https://support.checkpoint.com/results/sk/sk181597 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01162 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28134 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-23-1764 · Security Note
• https://t.me/cvenotify/93089 · Telegram Post