Security readout for executives and security teams
Plain-English summary
This flaw lets a logged-in Gaia Portal administrator with GUI Clients settings permission inject an operating-system command through the portal. It is not described as remotely exploitable without credentials. The business concern is misuse of privileged access or compromise of an admin account on Check Point Gaia systems that have not received the April 13, 2022 Jumbo HFA fixes.
Executive priority
Prioritize remediation on any internet-reachable or broadly accessible Gaia Portal systems. The vulnerability requires authenticated administrative access, but successful abuse could run commands on Gaia OS, making it important for firewall and security management environments.
Technical view
CVE-2021-30361 is a CWE-78 OS command injection issue in Check Point Gaia Portal GUI Clients settings. The cited description says authenticated administrators with permission to that settings area could run commands on Gaia OS. The affected range is listed only as Check Point Gaia Portal before Jumbo HFAs released April 13, 2022.
Likely exposure
Exposure is limited to Check Point Gaia Portal deployments older than the Jumbo HFAs released on April 13, 2022, where users have authenticated administrative access with GUI Clients settings permission. Internet exposure is not stated in the sources.
Exploitation context
The source bundle does not show CISA KEV listing or public active exploitation. The required attacker position is authenticated administrator-level access with a specific portal permission, so the main risk is compromised, malicious, or over-privileged admin accounts.
Researcher notes
Evidence is sparse: no CVSS vector, no detailed affected version matrix, and no exploit status beyond KEV being false. Treat this as command injection in a privileged administrative workflow and rely on Check Point sk179128 for authoritative fixed-build details.
Mitigation direction
- Install the applicable Check Point Jumbo HFA released on or after April 13, 2022.
- Review Check Point advisory sk179128 for exact fixed builds and deployment guidance.
- Restrict Gaia Portal administrative access to trusted management networks.
- Review and minimize administrator permissions for GUI Clients settings access.
- Monitor Gaia administrator activity for unexpected configuration or OS-level changes.
Validation and detection
- Inventory Check Point Gaia Portal systems and record installed Jumbo HFA levels.
- Confirm each affected system is at or beyond the April 13, 2022 fixed HFA level.
- Identify administrators with GUI Clients settings permission.
- Check whether Gaia Portal is reachable outside trusted administrative networks.
- Review admin audit logs around GUI Clients settings changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-78: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-30361 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://supportcontent.checkpoint.com/solutions?id=sk179128CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.