NewsCSO OnlinePublic sectorFinanceSME

    The firewall becomes the foothold: Attackers turn Check Point gateways against customers

    Share
    A firewall is intended to be a boundary attackers can’t cross. But firewalls face the web, making them just as vulnerable to attack as other systems, as evidenced by the emergency hotfixes released by Check Point Software for several of its products. The patches address a high-severity privilege escalation flaw, CVE-2026-123039 , that gives attackers root privilege access and the ability to send commands to the Gaia OS Dynamic CLI daemon, a core background process. Hackers have been exploiting the 7.8-rated vulnerability since late October, and Check Point said “a couple of dozen” customers have been impacted. Perhaps not surprisingly, adversaries gained initial access via PHP2Shell , the collective name for two critical PHP flaws tracked as CVE-2026-109618 and CVE-2026-109619. The 9.2-severity-rated bugs allow unauthenticated remote code execution (RCE). “For customers, one foothold delivered the full menu: Spying, staying, and destroying,” said Frank Dickson of Dickson Research. “For Check Point, the cost is trust. A firewall is supposed to be the strongest point in the network, not the softest.” Granting unintended root access CVE-2026-123039 is a bug in the Dynamic CLI IPC (Inter-Process Communication) interface which sends privileged command requests to the root-level Gaia OS Dynamic CLI. It is a local privilege escalation flaw, meaning an attacker already has to have local code execution ability on the appliance; this accounts for its 7.8 rating. Attackers first gained access to the Mobile Access portal by exploiting the PHP2Shell vulnerabilities . They then escalated privileges to root using the CVE-2026-123039 zero-day exploits. “Once attackers have root, they can run anything they like,” Dickson said. A management service on the appliance runs as root, listens on a local socket that any process on the box can write to, and never checks who is calling. In this case, the attackers hid web shells inside the templates the portal uses to build its login page, and installed a TSGA backdoor and TSProxy malware that survives reboots, tucks itself into backups and snapshots, and hides inside the appliance’s own processes, he explained. “That backdoor can copy the firewall configuration, which is essentially a blueprint of the network,” he said. It can also alter the firewall’s logs, concealing the attacker’s activities. Check Point reported that, after gaining root access, the attackers then pivoted from the compromised gateway to a VMware ESXi host over SSH, deployed the destroy_v6 wiper, and left politically themed messages signed by a group calling itself Dream Security Ltd during the destructive stage. Check Point advised security teams to immediately deploy the CVE-2026-123039 hotfixes, beginning with devices that expose Mobile Access to the internet. Those who can’t do so right away should stop the dynamic_server process and prevent it from restarting. However, they warned, this can come at the cost of some CLI commands. Dickson also advised customers to turn off Mobile Access where it is not used, keep management interfaces off the internet entirely, and run the advisory’s log checks on any gateway exposed since late October, then cut the cord between the firewall and the hypervisor. A potentially exposed gateway should never have a trusted path into VMware ESXi. They should also ship firewall logs off the box, as they happen, to a system the firewall cannot touch. Products impacted by CVE-2026-123039 include Check Point’s Firewall, Multi-Domain Security Management Server, Security Gateway, Security Management Server, and Scalable Platforms. Security tools are as big a target as what they protect Once attackers have root access, the device basically becomes a trusted launching point for attacks against other systems that would otherwise stay protected, explained Erik Avakian , a technical counselor at Infotech. By effectively controlling the gateway, they can execute a wide array of nefarious actions. The overall takeaway and irony of this, Avakian pointed out, is that the very technology organizations deploy to protect themselves can become one of their greatest vulnerabilities. “Organizations can no longer assume their security infrastructure is inherently secure simply because it’s designed to provide protection,” he said. In reality, it is as much of a target as the systems it’s protecting. Firewalls, VPN appliances, and security gateways are increasingly being targeted because they provide the greatest leverage and control, he noted. As such, security teams must treat these appliances as high value assets with the same access control safeguards, vulnerability management, monitoring, and incident response rigor applied to other critical infrastructure. This means aggressively patching internet facing systems, restricting management access, monitoring for unusual administrative activity, and looking for indications of persistence or lateral movement, he said. But patches don’t evict already established attackers, so security teams must investigate and, where necessary, rebuild affected systems from trusted images. And with AI accelerating attacks , CISOs should consider establishing a zero trust mindset and architecture collectively across the pillars of identity, network, applications, data, and devices, he said. Keep an eye on the edge Edge devices are primary targets, as they sit at the boundary, hold privileged access, and rarely get the endpoint monitoring that other systems do, noted Scott Miserendino , CTO at DataBee. Security appliances should be treated as the high-risk assets they’ve become. In addition to patching and applying mitigations, he advised, defenders should assume there’s been a breach, hunting for published indicators of compromise (IOCs), routinely investigating network and endpoint security logs, and segmenting networks to reduce blast radius. “Security tools aren’t automatically secure, so defend the defenders,” he said. And, Dickson pointed out, PHP2Shell will keep showing up because PHP sits underneath so much web software, including the portals bolted onto security appliances, so it should always be on defenders’ radar. The management plane is a key target Check Point is not alone as a victim of threat actors. Firewall management has become a favorite target for attackers across the industry. In January, for instance, Fortinet disclosed that attackers abused its FortiCloud single sign-on to log into other customers’ FortiGate and FortiManager devices and create administrator accounts. In July and September , CISA added Check Point management server flaws to its catalog of exploited vulnerabilities. That same month, the agency also added a Cisco Secure Firewall Management Center flaw, rated a perfect 10.0 in severity, that hands an unauthenticated attacker root access. And, in October, Palo Alto Networks warned of attacks on the PAN-OS management interface, again with “root on the firewall as the prize.” “The logic is simple,” Dickson said: “The management plane holds the rulebook for the entire network. Changing providers to one with fewer flaws is an option, but swapping vendors swaps one Achilles’ heel for another, he pointed out, as every vendor’s edge device has a web portal, and every web portal is a door. “The remedy is fewer doors,” he advised. “Shrink the internet-facing edge and put remote access behind one consistent identity policy.” Ultimately, he noted, a firewall is not a wall, it is a computer sitting on the internet. “Attackers are treating it like one,” he said. “Security teams should defend it like one.”

    Linked advisories

    Affected vendors and products

    More on firewall

    Other advisories

    Other news entries

    Source: https://www.csoonline.com/article/4248693/the-firewall-becomes-the-foothold-attackers-turn-check-point-gateways-against-customers.html

    ID