CVE-2019-8461

HIGH

Check Point Endpoint Security Initial Client for Windows <E81.30 - ...

Title source: llm

Description

Check Point Endpoint Security Initial Client for Windows before version E81.30 tries to load a DLL placed in any PATH location on a clean image without Endpoint Client installed. An attacker can leverage this to gain LPE using a specially crafted DLL placed in any PATH location accessible with write permissions to the user.

References (2)

Core 2

Core References

Patch, Vendor Advisory x_refsource_misc

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk160812

Exploit, Third Party Advisory x_refsource_misc

https://safebreach.com/Post/Check-Point-Endpoint-Security-Initial-Client-for-Windows-Privilege-Escalation-to-SYSTEM

Scores

CVSS v3 7.8

EPSS 0.0112

EPSS Percentile 62.0%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-114 CWE-426

Status published

Products (3)

checkpoint/capsule_docs_standalone_client < e80.20

checkpoint/endpoint_security < e81.30

checkpoint/remote_access_clients < e81.30

Published Aug 29, 2019

Tracked Since Feb 18, 2026