The vulnerability lies in the certificate validation logic of the deprecated IKEv1 key exchange. An unauthenticated attacker positioned as a man‑in‑the‑middle can bypass certificate checks for site‑to‑site VPN connections that use certificate‑based authentication. Successful exploitation permits interception or modification of all traffic flowing through the VPN tunnel, effectively compromising confidentiality and integrity of the communication channel.

The affected platforms are Checkpoint Quantum Security Gateway and Checkpoint Spark Firewalls. No specific firmware or software version information is supplied; therefore any deployment that still relies on IKEv1 for site‑to‑site VPNs is likely vulnerable.

The CVSS score of 7.4 indicates high severity, and although EPSS data is unavailable, the lack of a KEV listing suggests the vulnerability is not yet widely exploited in the wild. The likely attack vector involves an attacker spoofing one or both VPN peers to insert themselves between the legitimate endpoints, exploiting the IKEv1 certificate validation flaw to accept a forged or expired certificate and thereby gain full access to the tunnel traffic.