CVE-2022-23742: 
Check Point Harmony Endpoint vulnerability analysis and mitigation

Check Point Endpoint Security Client for Windows versions earlier than E86.40 contains a vulnerability identified as CVE-2022-23742. The vulnerability was discovered by Alain Rödel of cirosec GmbH and involves the copying of files for forensics reports from a directory with low privileges. The issue was disclosed and assigned on January 19, 2022 (CVE Details).

The vulnerability exists in the EFRService component of Check Point Endpoint Security Client for Windows. The service copies files for forensics reports from a directory with low privileges, which could be exploited through file manipulation. An attacker could potentially replace these files with malicious content or utilize symbolic links, including the possibility of exploiting CVE-2020-0896 on unpatched systems (CERT-FR).

The vulnerability could lead to local privilege escalation on affected systems. This security flaw potentially allows attackers to execute arbitrary code and elevate privileges on the compromised system (CERT-FR).

The vulnerability requires local access to the system and the ability to manipulate files in directories accessed by the EFRService component. The attack can be executed through file replacement with malicious content or by exploiting symbolic links (CVE Details).

The vulnerability has been addressed in Check Point Endpoint Security Client for Windows version E86.40 and later. Users are advised to upgrade to the latest version to mitigate this security risk (Check Point Response).