CVE-2022-23746

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The IPsec VPN blade has a dedicated portal for downloading and connecting through SSL Network Extender (SNX). If the portal is configured for username/password authentication, it is vulnerable to a brute-force attack on usernames and passwords.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-307

Affected software

Vendor	Product	Versions
n/a	Gateway & Management, IPsec VPN blade SNX portal.	R81.10 before take 79, R81 before take 77, R80.40 before take 180, R80.30 before take 255, R80.20 before 230

References

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk180271Mitigation, Patch, Vendor Advisory
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk180271Mitigation, Patch, Vendor Advisory

Timeline

Published: Nov 30, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-237479.8In Sony Xperia series 1, 5, and Pro, an out of bound memory access can occur due to lack of validation of the number of frames being passed CVE-2022-237487.8mDNSResponder.exe is vulnerable to DLL Sideloading attack. Executable improperly specifies how to load the DLL, from which folder and under CVE-2022-23755.4The WP Sticky Button WordPress plugin before 1.4.1 does not have authorisation and CSRF checks when saving its settings, allowing unauthenti CVE-2022-23765.3The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated a CVE-2022-237638.8Origin validation error vulnerability in NeoRS’s ActiveX moudle allows attackers to download and execute arbitrary files. Remote attackers c CVE-2022-237649.8The vulnerability causing from insufficient verification procedures for downloaded files during WebCube update. Remote attackers can bypass CVE-2022-237658.8This vulnerability occured by sending a malicious POST request to a specific page while logged in random user from some family of IPTIME NAS CVE-2022-237668.8An improper input validation vulnerability leading to arbitrary file execution was discovered in BigFileAgent. In order to cause arbitrary f CVE-2022-237679.8This vulnerability of SecureGate is SQL-Injection using login without password. A path traversal vulnerability is also identified during fil CVE-2022-237689.8This Vulnerability in NIS-HAP11AC is caused by an exposed external port for the telnet service. Remote attackers use this vulnerability to i CVE-2022-237699.8Remote code execution vulnerability due to insufficient user privilege verification in reverseWall-MDS. Remote attackers can exploit the vul CVE-2022-23774.3The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing any authenticated user