CVE-2022-23746

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-11-30 · updated 2026-06-17
Weakness: CWE-307

Description

The IPsec VPN blade has a dedicated portal for downloading and connecting through SSL Network Extender (SNX). If the portal is configured for username/password authentication, it is vulnerable to a brute-force attack on usernames and passwords.

Affected products

SSL Network Extender Client for Linux: r80.20, r80.20-take_10, r80.20-take_103, r80.20-take_117, r80.20-take_118, r80.20-take_127 (+184)

References

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk180271
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk180271

Get alerted when CVE-2022-23746 or the next vulnerability affects your stack