CVE-2021-30356

Check Point Identity Agent, before R81.018.0000, lets a low-privileged user overwrite protected system files — a link-following (symlink) weakness where the agent writes to a path an unprivileged user can redirect, clobbering files they shouldn't be able to touch. It's reported as a denial-of-service issue, and the impact bears that out: integrity and availability are hit, confidentiality is not. This is about corrupting protected files on a machine, not stealing data from it.

The key precondition is that the attacker is already a low-privileged user on a host running the agent, so this is a local abuse of trust, not a remote break-in. The realistic outcome is a user overwriting protected system files to disrupt the endpoint — degrading or disabling functionality, or potentially tampering with files in a way that undermines the security agent itself. That local, already-authenticated requirement is what keeps it in the high-but-not-critical band despite the file-overwrite power; nobody reaches this without first being on the box.

Our angle is standard agent-fleet patch coverage weighted by where untrusted local users exist. We'd update Identity Agent to R81.018.0000 or later across managed endpoints, prioritizing shared or multi-user machines where a low-privileged user turning to file corruption is most plausible. Because a symlink flaw that lets a user tamper with a security agent's own files can undercut endpoint defenses, we rank it a notch above a plain DoS and fold it into normal endpoint-agent maintenance rather than emergency response.