Unscored severity · published Nov 30, 2013
CVE-2013-5636
Unlock.exe in Media Encryption EPM Explorer in Check Point Endpoint Security through E80.50 does not associate password failures with a device ID, which makes it easier for…
–
CVSS
0.2%
EPSS
No
On KEV
Description
Unlock.exe in Media Encryption EPM Explorer in Check Point Endpoint Security through E80.50 does not associate password failures with a device ID, which makes it easier for physically proximate attackers to bypass the device-locking protection mechanism by overwriting DVREM.EPM with a copy of itself after each few password guesses.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
Endpoint Security · Checkpoint
e80; e80.10; e80.20; e80.30; e80.40; e80.41; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-5636
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-5636
www.digitalsec.net
http://www.digitalsec.net/stuff/explt+advs/CheckPoint_EndPoint_EPM_Explorer.txt
Patch
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk96589
More from Endpoint Security
7.8
CVE-2023-28134
Local attacker can escalate privileges on affected installations of Check Point Harmony Endpoint/ZoneAlarm Extreme Security
7.8
CVE-2023-28133
Local privilege escalation in Check Point Endpoint Security Client (version E87.30) via crafted OpenSSL configuration file
7.8
CVE-2022-23742
Check Point Endpoint Security Client for Windows versions earlier than E86.40 copy files for forensics reports from a directory with low privileges
7.8
CVE-2021-30360
Users have access to the directory where the installation repair occurs
7.8
CVE-2020-6021
Check Point Endpoint Security Client for Windows before version E84.20 allows write access to the directory from which the installation repair takes place