CVE-2023-28134
📋 TL;DR
CVE-2023-28134 is a local privilege escalation vulnerability in Check Point Harmony Endpoint and ZoneAlarm Extreme Security. An attacker with low-privileged code execution on a system can exploit this to gain elevated privileges. This affects organizations using these security products on their endpoints.
💻 Affected Systems
- Check Point Harmony Endpoint
- ZoneAlarm Extreme Security
📦 What is this software?
Endpoint Security by Checkpoint
Endpoint Security by Checkpoint
Endpoint Security by Checkpoint
⚠️ Risk & Real-World Impact
Worst Case
An attacker gains full SYSTEM/root privileges on the endpoint, allowing complete control, data theft, lateral movement, and persistence.
Likely Case
Malware or compromised user accounts escalate privileges to bypass security controls, install additional malware, or access sensitive data.
If Mitigated
With proper patching and least privilege principles, impact is limited to isolated endpoints with minimal data exposure.
🎯 Exploit Status
Exploitation requires initial low-privileged access; no public exploit code known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: E86.40 and later
Vendor Advisory: https://support.checkpoint.com/results/sk/sk181597
Restart Required: Yes
Instructions:
1. Update Check Point Harmony Endpoint/ZoneAlarm to version E86.40 or later via the management console. 2. Deploy updates to all endpoints. 3. Restart affected systems.
🔧 Temporary Workarounds
Restrict local user privileges
windowsApply least privilege principles to limit low-privileged code execution opportunities.
🧯 If You Can't Patch
- Monitor for suspicious privilege escalation attempts using endpoint detection tools.
- Isolate affected systems from critical network segments to limit lateral movement.
🔍 How to Verify
Check if Vulnerable:
Check the installed version of Check Point Harmony Endpoint/ZoneAlarm via the client interface or management console.Check Version:
Not applicable; use GUI or management console.Verify Fix Applied:
Confirm version is E86.40 or later in the product interface.📡 Detection & Monitoring
Log Indicators:
- Unexpected process elevation events
- Security product service anomalies
Network Indicators:
- Unusual outbound connections from endpoints post-exploit
SIEM Query:
Endpoint logs showing privilege escalation from low to high integrity levels.