CVE-2022-23744 Security feature bypass in Enterprise Endpoint Security Windows Clients.
A local administrator can disable endpoint protection by modifying the registry, bypassing security controls in Check Point Endpoint Security.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-23744?
CVE-2022-23744 is a low-severity vulnerability in Enterprise Endpoint Security Windows Clients., published on 7 Jul 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Check Point Endpoint before version E86.50 failed to protect against specific registry change which allowed to disable endpoint protection by a local administrator.
Weakness: CWE-470
Which versions are affected by CVE-2022-23744?
It affects 2 products.
Products include Checkpoint Endpoint Security, Checkpoint Harmony Endpoint.
How do I fix CVE-2022-23744?
No fix has been published for CVE-2022-23744 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-23744 being exploited?
There is no known exploitation of CVE-2022-23744 in the wild and no public exploit code.
Other vulnerabilities in Enterprise Endpoint Security Windows Clients.
- CVE-2023-28134 Local Privliege Escalation in Check Point Endpoint Security Remediation Service
- CVE-2023-28133 Privilege escalation in Harmony Endpoint.
- CVE-2022-23742 Path traversal in Check Point Endpoint Security Client for Windows
- CVE-2021-30360 Privilege escalation in Check Point Remote Access Client
- CVE-2020-6021 Privilege escalation in Check Point Endpoint Security Client for Windows
Sources
Also known as GHSA-29gh-3cpv-qpjp.