CVE-2008-5849: Check Point VPN-1

Medium severity, CVSS 5.0. EPSS: 1.6% chance of exploitation in the next 30 days.

Check Point VPN-1 R55, R65, and other versions, when Port Address Translation (PAT) is used, allows remote attackers to discover intranet IP addresses via a packet with a small TTL, which triggers an ICMP_TIMXCEED_INTRANS (aka ICMP time exceeded in-transit) response containing an encapsulated IP packet with an intranet address, as demonstrated by a TCP packet to the firewall management server on port 18264.

Affected products

• Check Point VPN-1: version r55 only; version r65 only

Published 2009-01-06. Last modified 2026-06-16.