Check Point
This is rated high severity (7.8 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Check Point Multiple Products is in your estate, and treat that as the priority.
The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root.
Exploitable only with local access and a low-privilege account, and no one has to click or open anything. High impact on confidentiality, integrity and availability.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability
Longer bar: easier to attack
Impact
Longer bar: more harm
2 links from the CVE record, grouped by site.
support.checkpoint.com1 link
cisa.gov1 link
Check Point has identified a critical vulnerability in multiple products that allows attackers to assign incorrect permissions to critical resources, potentially enabling privilege escalation.
Next step: Confirm whether Check Point is in your estate.
Who's reporting
1 of 3 perspectives
Official authority: Official 1Vendor statement missing. no VendorResearcher coverage missing. no Researcher1 signal
Only official coverage so far. Treat as an early signal.
CISA has added two new vulnerabilities to its known-exploited catalogue, based on evidence of active exploitation.
