A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products 93
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:*:*:*:*:*:*:*:*
|
r80.40
|
r81.20
|
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r81.20:-:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_10:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_101:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_103:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_105:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_111:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_113:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_115:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_118:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_119:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_120:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_122:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_126:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_127:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_14:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_141:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_24:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_26:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_38:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_41:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_43:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_45:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_53:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_54:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_65:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_70:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_76:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_79:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_8:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_84:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_89:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_90:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_92:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_96:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_98:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_99:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r82:-:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r82:take_10:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r82:take_103:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r82:take_12:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r82:take_14:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r82:take_18:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r82:take_19:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r82:take_25:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r82:take_33:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r82:take_34:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r82:take_36:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r82:take_39:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r82:take_41:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r82:take_43:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r82:take_44:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r82:take_60:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r82:take_73:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r82:take_91:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r82.10:-:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r82.10:take_19:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Os
cpe:2.3:o:checkpoint:gaia_os:r82.10:take_6:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Embedded
cpe:2.3:o:checkpoint:gaia_embedded:*:*:*:*:*:*:*:*
|
r80.20.00
|
r81.10.17
|
|
Checkpoint Gaia_Embedded
cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:-:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Embedded
cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004508:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Embedded
cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004620:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Embedded
cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004653:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Embedded
cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004721:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Embedded
cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004892:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Spark_1530
cpe:2.3:h:checkpoint:quantum_spark_1530:-:*:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Spark_1550
cpe:2.3:h:checkpoint:quantum_spark_1550:-:*:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Spark_1570
cpe:2.3:h:checkpoint:quantum_spark_1570:-:*:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Spark_1570r
cpe:2.3:h:checkpoint:quantum_spark_1570r:-:*:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Spark_1590
cpe:2.3:h:checkpoint:quantum_spark_1590:-:*:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Spark_1595r
cpe:2.3:h:checkpoint:quantum_spark_1595r:-:*:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Spark_1600
cpe:2.3:h:checkpoint:quantum_spark_1600:-:*:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Spark_1800
cpe:2.3:h:checkpoint:quantum_spark_1800:-:*:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Spark_1900
cpe:2.3:h:checkpoint:quantum_spark_1900:-:*:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Spark_2000
cpe:2.3:h:checkpoint:quantum_spark_2000:-:*:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Embedded
cpe:2.3:o:checkpoint:gaia_embedded:*:*:*:*:*:*:*:*
|
r80.20.00
|
r82.00.10
|
|
Checkpoint Gaia_Embedded
cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:-:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Embedded
cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998001559:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Embedded
cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998001562:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Embedded
cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002110:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Embedded
cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002112:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Embedded
cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002133:*:*:*:*:*:*
|
— | — |
|
Checkpoint Gaia_Embedded
cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002203:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Spark_1535
cpe:2.3:h:checkpoint:quantum_spark_1535:-:*:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Spark_1555
cpe:2.3:h:checkpoint:quantum_spark_1555:-:*:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Spark_1575
cpe:2.3:h:checkpoint:quantum_spark_1575:-:*:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Spark_1575r
cpe:2.3:h:checkpoint:quantum_spark_1575r:-:*:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Spark_2530
cpe:2.3:h:checkpoint:quantum_spark_2530:-:*:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Spark_2550
cpe:2.3:h:checkpoint:quantum_spark_2550:-:*:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Spark_2560
cpe:2.3:h:checkpoint:quantum_spark_2560:-:*:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Spark_2570
cpe:2.3:h:checkpoint:quantum_spark_2570:-:*:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Spark_2580
cpe:2.3:h:checkpoint:quantum_spark_2580:-:*:*:*:*:*:*:*
|
— | — |
|
Checkpoint Quantum_Spark_2590
cpe:2.3:h:checkpoint:quantum_spark_2590:-:*:*:*:*:*:*:*
|
— | — |
References 3
https://support.checkpoint.com/results/sk/sk185033
cve@checkpoint.com
https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-…
134c704f-9b21-4f2e-91b3-4a467353bcc0
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026…
134c704f-9b21-4f2e-91b3-4a467353bcc0