Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2000-1037 — Improper Control of Interaction Frequency in Checkpoint Firewall-1

5 documents4 sources
Severity
7.5HIGHNVD
EPSS
12.1%
top 6.18%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Checkpoint Firewall-1
Timeline
PublishedDec 11
Latest updateApr 30

Description

Check Point Firewall-1 session agent 3.0 through 4.1 generates different error messages for invalid user names versus invalid passwords, which allows remote attackers to determine valid usernames and guess a password via a brute force attack.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages1 packages

▶NVDcheckpoint/firewall-13.0, 4.0, 4.1+2

🔴Vulnerability Details

2
GHSA
GHSA-7hp5-rh59-f624: Check Point Firewall-1 session agent 3↗2022-04-30
▶
CVEList
CVE-2000-1037: Check Point Firewall-1 session agent 3↗2000-11-29
▶

💥Exploits & PoCs

2
Exploit-DB
Check Point Software Firewall-1 3.0/1 4.0/1 4.1 - Session Agent Dictionary Attack (2)↗2000-10-01
▶
Exploit-DB
Check Point Software Firewall-1 3.0/1 4.0/1 4.1 - Session Agent Dictionary Attack (1)↗2000-08-15
▶
CVE-2000-1037 — Checkpoint Firewall-1 vulnerability | cvebase