CVE-2002-2405: Check Point FireWall-1 4.1 and Next Generation (NG), with UserAuth configured to proxy HTTP traffic only, a...

Security readout for executives and security teams

This CVE describes a firewall policy bypass. In a specific Check Point FireWall-1 UserAuth setup intended to proxy only HTTP, an attacker may be able to pass HTTPS, FTP, and possibly other traffic through the firewall without authorization. Exposure appears limited to organizations still running Check Point FireWall-1 4.1 or Next Generation with UserAuth configured as an HTTP-only proxy. Modern Check Point deployments are not identified in the provided sources. Prioritize only if these legacy Check Point firewall configurations remain in use. The business concern is unauthorized traffic crossing a firewall boundary, but source evidence is incomplete and no active exploitation is cited. Mitigation focus: Check Check Point guidance for FireWall-1 4.1/NG and UserAuth proxy behavior.; Review and harden firewall rules blocking unauthorized HTTPS, FTP, and other outbound protocols.; Disable HTTP-only UserAuth proxy exposure if vendor guidance cannot be confirmed..

Prepared

Jun 29, 2026, 01:47 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.