« Volver al listado

CVE-2024-6233

Estado: AnalizadaAlta (7.8)—

Check Point ZoneAlarm Extreme Security Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Check Point ZoneAlarm Extreme Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the Forensic Recorder service. By creating a symbolic link, an attacker can abuse the service to overwrite arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-21677.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vector AV:L/PR:L sin UI: escalada local. Seguimiento de enlace simbólico (CWE-59) para sobrescribir archivos y ejecutar código SYSTEM. Impactos: privilegios elevados y ejecución arbitraria.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution PreventionThreat Intelligence ProgramRestrict Web-Based ContentPrivileged Account ManagementLimit Software InstallationBehavior Prevention on Endpoint

Tecnologías afectadas (1)

Checkpoint — Zonealarm Extreme Security Nextgen

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-6233",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-6233",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-22T20:43:03.859640Z"
        }
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "zdi-disclosures@trendmicro.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "zdi-disclosures@trendmicro.com",
      "affectedData": [
        {
          "vendor": "Check Point",
          "product": "ZoneAlarm Extreme Security",
          "versions": [
            {
              "status": "affected",
              "version": "4.0.148.0"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:check_point:zonealarm_extreme_security:4.0.148.0:*:*:*:*:*:*:*"
          ],
          "vendor": "check_point",
          "product": "zonealarm_extreme_security",
          "versions": [
            {
              "status": "affected",
              "version": "4.0.148.0"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-11-22T20:15:11.437",
  "references": [
    {
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1036/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "zdi-disclosures@trendmicro.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "zdi-disclosures@trendmicro.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-59"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Check Point ZoneAlarm Extreme Security Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Check Point ZoneAlarm Extreme Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the Forensic Recorder service. By creating a symbolic link, an attacker can abuse the service to overwrite arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-21677."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de escalada de privilegios locales en Check Point ZoneAlarm Extreme Security. Esta vulnerabilidad permite a los atacantes locales escalar privilegios en las instalaciones afectadas de Check Point ZoneAlarm Extreme Security. Un atacante primero debe obtener la capacidad de ejecutar código con pocos privilegios en el sistema de destino para explotar esta vulnerabilidad. La falla específica existe dentro del servicio Forensic Recorder. Al crear un enlace simbólico, un atacante puede abusar del servicio para sobrescribir archivos arbitrarios. Un atacante puede aprovechar esta vulnerabilidad para escalar privilegios y ejecutar código arbitrario en el contexto de SYSTEM. Era ZDI-CAN-21677."
    }
  ],
  "lastModified": "2026-06-17T08:17:35.657",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:checkpoint:zonealarm_extreme_security_nextgen:4.0.148:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "130B6C1E-026A-4322-95BD-366B555CC689"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "zdi-disclosures@trendmicro.com"
}