CVE-2000-0805: Check Point VPN-1/FireWall-1 4.1 and earlier improperly retransmits encapsulated FWS packets, even if they...

Security readout for executives and security teams

An old flaw in Check Point VPN-1/FireWall-1 version 4.1 and earlier allowed the firewall to retransmit encapsulated FWZ packets even when they did not originate from a legitimate FWZ client. In practical terms, an attacker could push traffic through the firewall by spoofing packets that should have been rejected, undermining the trust boundary the product was meant to enforce. Exposure is limited to organizations still running Check Point VPN-1/FireWall-1 4.1 or earlier, a product line from around 2000. Any environment still operating that version is well past vendor support and likely already exposed to many higher-severity issues. Modern Check Point deployments are not in scope for this specific CVE. Low priority for most organizations. This is a legacy vulnerability in a firewall product line from around 2000; only businesses still operating unsupported Check Point 4.x gateways need to act, and those should already be on a replacement plan for broader support and compliance reasons. Mitigation focus: Upgrade any remaining VPN-1/FireWall-1 4.1 or earlier gateways to a currently supported Check Point release.; Consult Check Point's advisory referenced in the sources for vendor-specific guidance on FWZ retransmission handling.; Restrict or retire FWZ encapsulation in favor of modern IPsec-based VPN configurations where feasible..

Prepared

Jul 12, 2026, 00:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.