CVE-2020-6024: Checkpoint SmartConsole Privilege Escalation

CVE-2020-6024 Overview

Check Point SmartConsole contains a local privilege escalation vulnerability affecting multiple releases before specific patch builds. The application runs executables from a directory that grants write access to all authenticated users. An attacker with local access can replace or plant binaries in this directory, causing SmartConsole to execute attacker-controlled code with elevated privileges. The flaw is tracked under [CWE-114] Process Control and [CWE-269] Improper Privilege Management. Check Point addressed the issue through updated builds documented in Check Point Support Solution sk142952.

Critical Impact
Authenticated local users can escalate privileges by placing malicious executables in a writable directory used by SmartConsole, resulting in full compromise of confidentiality, integrity, and availability on the affected host.

Affected Products

Check Point SmartConsole R80.10 before Build 185
Check Point SmartConsole R80.20 before Build 119, R80.30 before Build 94
Check Point SmartConsole R80.40 before Build 415 and R81 before Build 548

Discovery Timeline

2021-01-20 - CVE-2020-6024 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-6024

Vulnerability Analysis

The vulnerability classifies as a local privilege escalation caused by insecure directory permissions. SmartConsole executes binaries located in a directory writable by all authenticated users. Any local user can drop or overwrite executables in that path. When SmartConsole or a privileged process later launches one of those binaries, the attacker-supplied code runs in the context of the calling process. The flaw aligns with [CWE-114] Process Control and [CWE-269] Improper Privilege Management. The EPSS probability of public exploitation is low, and no public proof-of-concept or CISA KEV entry exists at the time of writing.

Root Cause

The root cause is incorrect access control on the installation directory containing SmartConsole executables. The directory inherits write permissions for the Authenticated Users group, which violates the principle of least privilege for binaries executed by higher-privileged contexts. Combined with the application's reliance on those binaries without integrity verification, this design allows unauthorized binary substitution.

Attack Vector

Exploitation requires local authenticated access to a host running a vulnerable SmartConsole build. The attacker writes a malicious executable into the writable SmartConsole directory, replacing or shadowing a legitimate binary. When an administrator or scheduled task invokes SmartConsole, the planted binary executes with the invoker's privileges. The attack vector is local with low complexity and low privileges required, and no user interaction beyond normal application use is necessary.

No verified public exploit code is available. See Check Point Support Solution sk142952 for vendor technical details.

Detection Methods for CVE-2020-6024

Indicators of Compromise

Unexpected executable or DLL files written to the SmartConsole installation directory by non-administrative users.
Process creation events where SmartConsole or its child processes launch binaries with modification timestamps inconsistent with the installed build.
File integrity changes on signed Check Point binaries without a corresponding software update event.

Detection Strategies

Audit NTFS access control lists on the SmartConsole install path and alert when Authenticated Users or Users hold write or modify rights.
Monitor process lineage for SmartConsole executables spawning unsigned or unexpected child processes.
Correlate file write events in the SmartConsole directory with the originating user SID to flag non-administrator modifications.

Monitoring Recommendations

Enable Windows Security event ID 4663 on the SmartConsole directory to capture write and modify operations.
Forward endpoint process and file telemetry to a centralized analytics platform for retroactive hunting across SmartConsole hosts.
Baseline the expected file set under the SmartConsole installation path and alert on additions or replacements.

How to Mitigate CVE-2020-6024

Immediate Actions Required

Upgrade SmartConsole to R80.10 Build 185, R80.20 Build 119, R80.30 Build 94, R80.40 Build 415, R81 Build 548, or later as documented in vendor guidance.
Restrict the SmartConsole installation directory ACL to administrators only and remove write rights from Authenticated Users.
Limit interactive logon on management workstations to administrators with a justified need to operate SmartConsole.

Patch Information

Check Point fixed the issue in SmartConsole R80.10 Build 185, R80.20 Build 119, R80.30 Build 94, R80.40 Build 415, and R81 Build 548. Refer to Check Point Support Solution sk142952 for download links and upgrade procedures.

Workarounds

Manually tighten directory permissions on the SmartConsole install path using icacls to remove write access for non-administrative users.
Deploy application allowlisting to block execution of binaries from the SmartConsole directory that are not signed by Check Point Software Technologies.
Run SmartConsole only from administrator-controlled workstations that prevent standard users from logging in locally.

bash

# Configuration example
icacls "C:\Program Files (x86)\CheckPoint\SmartConsole" /remove:g "Authenticated Users"
icacls "C:\Program Files (x86)\CheckPoint\SmartConsole" /remove:g "Users"
icacls "C:\Program Files (x86)\CheckPoint\SmartConsole" /grant:r "Administrators:(OI)(CI)F"