Low Severity
CVE-2026-123039
Published: Nov 14, 2026
Containerised PoC for CVE-2026-123039: the Check Point Gaia OS Dynamic CLI daemon publishes /tmp/dynamic_socket world-writable and authenticates no caller, so any local user escalates to root. Differential lab (affected vs patched), 4-mode PoC, 0day sweep.
# CVE-2026-123039 — Check Point Gaia OS Dynamic CLI world-writable control socket allows a local user to execute commands as root
| | |
|---|---|
| **CVE** | CVE-2026-123039 |
| **Component** | Check Point Gaia OS — Dynamic / Extended CLI daemon, `/usr/bin/dynamic_server` |
| **Affected** | Gaia OS R81, R81.10, R81.20, R82, R82.10, R82.20 — Quantum Security Gateways and Force firewalls, Security Management and Log Servers, Multi-Domain Security Management and Log Servers, Maestro / Scalable Platforms. Check Point Spark firewalls and Smart-1 Cloud are not affected. |
| **Fixed in** | The security hotfix for advisory `sk1000362`, delivered through the monthly Jumbo Hotfix Accumulator of the affected branches |
| **CWE** | CWE-732 (Incorrect Permission Assignment for Critical Resource) and CWE-862 (Missing Authorization) |
| **Impact** | Local privilege escalation to root: an arbitrary command string written into the control socket is executed with the privileges of the daemon |
| **CVSS** | 7.8 `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` |
| **Vector** | The local AF_UNIX control socket `/tmp/dynamic_socket`, published by the root daemon `dynamic_server` |
| **Trigger** | The command string an unprivileged local process writes into the socket, framed as `#<length># <command>` |
| **Advisory** | Check Point `sk1000362` |
| **Mitigation** | `dbset process:dynamic_server off` followed by `dbset :save` in Expert mode |
| **Indicators** | `/var/log/dynamicCli.log` — the daemon records every request it accepts |
The Gaia OS Dynamic CLI (`sk144112`) maps expert-mode diagnostic commands into the
restricted `clish` shell. The mapping is served by `dynamic_server`, a daemon that runs
as root and owns the local control socket `/tmp/dynamic_socket`. On affected builds the
socket is created world writable and the daemon neither authenticates nor authorizes
the process that connects to it, so any authenticated local account — a service
account, a portal worker, an interactive