A logic flow weakness in the certificate validation path for the deprecated IKEv1 key exchange allows an unauthenticated attacker to bypass user authentication and establish a remote access VPN connection without a valid user password. The flaw enables the attacker to create a link to the gateway with no prior credentials, thereby granting unauthorized access to the internal network and all resources behind the gateway. This vulnerability falls under CWE-287 (Authentication Bypass by Missing or Incorrect Authentication).

The vulnerability affects Check Point’s Quantum Security Gateway and Spark Firewalls. No specific product versions are listed deployments of these gateway releases that use the affected IKEv1 logic are potentially vulnerable.

The CVSS score of 9.3 indicates critical severity, and the EPSS score of 71% shows a high probability of exploitation. The vulnerability is listed in CISA’s KEV catalog. Based on the description, it is inferred that the likely attack vector is network-based, requiring only connectivity to the VPN service and the ability to construct a malicious certificate that triggers the logic flaw. Attackers would benefit from exposed VPN interfaces; no special user or system privileges are needed. No publicly disclosed exploits are referenced in the CVE data, but the vulnerability permits credentialless access, making it significant for administrators to act promptly.