Hardening Recommendation Report Now Includes CVE Exposure Visibility

[Eran_Habad]

Hi all,

Recently, we launched the Hardening Recommendation Report in Web SmartConsole, enabling administrators to review and improve the security posture of their Security Gateways and Management Servers.

Today, we're extending the Hardening Recommendation Report with CVE Exposure visibility, helping security teams quickly identify vulnerable devices, prioritize remediation efforts, and better understand their overall risk exposure.

The report now highlights known Check Point CVEs affecting Security Gateways and Management Servers, indicates whether each applicable CVE is patched, and provides actionable remediation information for devices that still require attention.

An illustrated example:

The report summary includes:

• Unpatched CVEs – The number of known CVEs that remain unpatched and the number of affected devices.
• Highest CVSS Exposure – The highest CVSS score among all unpatched CVEs detected in the environment.

Also, for each device, the report provides detailed vulnerability information, including any unpatched Check Point CVEs and the corresponding remediation path. When a CVE is resolved in a later Jumbo Hotfix, the report displays the required JHF take that contains the fix. When a CVE is addressed through Check Point Live Patch, the report provides the patch installation status. If the patch was successfully installed, the CVE in the device is marked as patched. If the patch installation failed, the report displays the reason for the failure to help administrators take the necessary corrective actions.

With CVE Exposure integrated directly into the Hardening Recommendation Report, security teams can more easily assess their exposure, prioritize remediation efforts, and ensure critical security updates are applied across their environment 🚀

• For more information about the Hardening Report and the new CVE Exposure capabilities, refer to: sk185102 - Hardening Recommendation Report
• For more information about Check Point Live Patch, refer to: sk185114 - Check Point Live Patch (CPLP)

As always, we'd love to hear your feedback and suggestions for future improvements.

Eran

[JozkoMrkvicka]

Is the Hardening Recommendation Report visible ONLY in WSC (Web SmartConsole) ? Or also on installed SC ?

[Lesley]

Only Webconsole. Not installed SmartConsole

[CaseyB]

Awesome!

Looks like there is a discrepancy between a Cluster Object and Cluster Members though.

[Lesley]

I had the same, this needs to be tweaked, it shows different stuff, that might cause people to get confused. 

[EVeloso]

Same situation here.
In the cluster, the status is "unpatched - install jumbo hotfix", but in each member, it says there is no CVE exposure.

[Lesley]

Are spark firewalls supported? They seem to be included but I see data some data is not correct. R82.0.10 spark firmware. 

[CaseyB]

I was wondering the same on the spark appliances. Our 1535 devices are fully patched, and the CVE list is looking rough.

[Eran_Habad]

Thanks for the feedback @CaseyB and @Lesley. I'll reach out directly to each of you to review this.

[Eran_Habad]

Thanks again for the feedback @CaseyB and @Lesley.

I acknowledge that the current results for the Cluster Gateway itself and for Spark Gateways are not accurate and can be disregarded. It is important to note, however, that for cluster Gateways, the results reported for the individual cluster members are accurate and provide the full information you need.

We have already identified the issue and a fix is scheduled to be released early next week. The update will be deployed automatically for customers with automatic updates enabled.

[D_TK]

Is this available in the fat client SC?  We only use p12 certs for SC logon so web con is not available to us.

[Eran_Habad]

Hi, as stated above it's not available through SmartConsole, only through Web SmartConsole. However, we'll check the option to retrieve the file manually and directly from the Management Server itself (it will require SSH/SCP access to the Management though).