Check Point Security Gateways Vulnerability Allows Remote Access Attacks
CVE-2024-24919
Key Information:
- Vendor
- Checkpoint
- Vendor
- CVE Published:
- 28 May 2024
Badges
What is CVE-2024-24919?
CVE-2024-24919 is a vulnerability found in Check Point Security Gateways, which are integral components in network security that provide robust protection against various cyber threats. This vulnerability specifically permits attackers to read sensitive information from these gateways when they are enabled with remote access VPN or Mobile Access Software Blades and exposed to the internet. The implications for organizations are significant, as it could lead to unauthorized access to critical information, undermining the security of their network infrastructure.
Technical Details
The vulnerability arises from specific configurations that allow unauthorized individuals to exploit remote access features of Check Point Security Gateways. When connected to the internet, these gateways can inadvertently expose sensitive internal information if not properly secured. The vulnerability has been cataloged as a critical issue, prompting Check Point to release a security fix aimed at mitigating the associated risks. Organizations must ensure that they implement this fix to safeguard their systems.
Impact of the Vulnerability
-
Unauthorized Information Access: Attackers can potentially gain access to sensitive data flowing through the Check Point Security Gateways, leading to data breaches and leaks of confidential information.
-
Increased Risk of Cyber Attacks: With the ability to read information, attackers may gather intelligence that facilitates further exploits, increasing the overall risk of comprehensive cyber attack strategies against an organization.
-
Reputation Damage: The exposure of sensitive information and the realization of a security breach can lead to significant reputational harm for organizations, affecting customer trust and investor confidence.
CISA Reported
CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace as recent news articles suggest the vulnerability is being used by ransomware groups.
The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Affected Version(s)
Check Point Quantum Gateway, Spark Gateway and CloudGuard Network Check Point Quantum Gateway and CloudGuard Network versions R81.20, R81.10, R81, R80.40 and Check Point Spark versions R81.10, R80.20.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
Get notified when SecurityVulnerability.io launches alerting π
Well keep you posted π§
News Articles
Threat Actors Actively Exploiting CVE-2024-24919: Underground Forums Share IP Addresses of Vulnerable Check Point Security Gateway Devices - CYFIRMA
Published On : 2024-07-12 EXECUTIVE SUMMARY A critical vulnerability, identified as CVE-2024-24919, has been discovered in certain End-of-life (EOL) devices that no longer receive updates or patches...
3 months ago
Huge Surge in Attacks Exploiting Check Point VPN Zero-Day Vulnerability
Check Point published an advisory regarding a critical vulnerability, CVE-2024-24919, which has since seen a surge in exploitation attempts.
7 months ago
Attacks Surge on Check Point's Recent VPN Zero-Day Flaw
One monitoring firm has detected exploitation attempts targeting CVE-2024-24919 from more than 780 unique IP addresses in the past week.
7 months ago
References
EPSS Score
94% chance of being exploited in the next 30 days.
CVSS V3.1
Timeline
- π‘
Public PoC available
- π₯
Vulnerability reached the number 1 worldwide trending spot
- π
Vulnerability started trending
- π¦
CISA Reported
- π°
Used in Ransomware
- πΎ
Exploit known to exist
- π°
First article discovered by TechTarget
Vulnerability published
Vulnerability Reserved