Marking Your Own Homework Check Point Remote Access VPN IKEv...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://labs.watchtowr.com/marking-your-own-homework-check-point-remote-access-vpn-ikev1-authentication-bypass-cve-2026-50751
• Blog Title: Marking Your Own Homework: Check Point Remote Access VPN IKEv1 Authentication Bypass (CVE-2026-50751)
• Suggested Section: Network Services Pentesting > 500/udp - Pentesting IPsec/IKE VPN > Check Point IKEv1 authentication bypass (CVE-2026-50751), cross-referenced from 264 - Pentesting Check Point FireWall-1

🎯 Content Summary

Overview and impact

CVE-2026-50751 is a critical Check Point Remote Access VPN authentication bypass affecting the deprecated IKEv1 implementation, with a CVSS score of 9.3. Check Point released hotfix sk185033 on June 8, 2026 for affected Mobile Access/SSL VPN, Remote Access VPN, and Spark Firewall products. The affected Gaia branches are R80.20.X, R80.40, R81, R81.10, ...

🔧 Technical Details

Client-controlled authentication policy: Protocol capability fields must never control whether server-side authentication executes. Here, a proprietary IKE Vendor ID beginning with 3c f1 87 b2 47 40 29 ea 46 ac 7f d0 ea f2 89 f5 accepts four trailing bytes as a capability word. The server byte-swaps this attacker-controlled value and stores it directly in a phase-1 state field consulted by authentication routines. Appending 0x00000004 sets the bit that disables the principal phase-1 verifier.

Authentication bypass through short-circuit evaluation: Security checks placed behind attacker-controlled Boolean operands can be skipped through normal language semantics. A condition equivalent to ((flags & 4) != 0) || verify() never calls verify() when bit 0x4 is set and immediately follows the success branch. Likewise, (flags & 2) && process_signature() skips...

🤖 Agent Actions

Implemented the HackTricks update.

Changed

• src/network-services-pentesting/ipsec-ike-vpn-pentesting.md
  • Added the Check Point IKEv1 authentication bypass technique.
  • Documented capability flags, short-circuit logic, forged certificate flow, PoC usage, Visitor Mode transport, detection, and remediation.
  • Added numbered references to watchTowr research, PoC, and Check Point advisory.
• src/network-services-pentesting/pentesting-264-check-point-firewall-1.md
  • Added a cross-reference to the new IKEv1 section and corresponding reference.

Validation

• git diff --check passed.
• Citation/reference numbering and Markdown fences validated.
• All referenced URLs returned HTTP 200.
• No forbidden sources were added.
• mdbook was unavailable in the environment.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://labs.watchtowr.com/marking-your-own-homework-check-point-remote-access-vpn-ikev1-authentication-bypass-cve-2026-50751

Content Categories: Based on the analysis, this content was categorized under "Network Services Pentesting > 500/udp - Pentesting IPsec/IKE VPN > Check Point IKEv1 authentication bypass (CVE-2026-50751), cross-referenced from 264 - Pentesting Check Point FireWall-1".

Repository Maintenance:

• MD Files Formatting: 1029 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0