CVE-2022-41604
High
Description
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. This occurs because of weak permissions for the %PROGRAMDATA%\CheckPoint\ZoneAlarm\Data\Updates directory, and a self-protection driver bypass that allows creation of a junction directory. This can be leveraged to perform an arbitrary file move as NT AUTHORITY\SYSTEM.
SeverityHigh
CVSS8.8
Exploit probability—
ProductCheckpoint Zonealarm
PublishedSep 27, 2022
First seenSep 27, 2022
Weakness typeCWE-269Improper privilege management
How to fix
Update
- checkpoint zonealarm15.8.211.19229 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| checkpoint zonealarm | v < 15.8.211.19229 | 15.8.211.19229 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.