Check Point Security Gateways Vulnerability Allows Remote Access Attacks
CVE-2024-24919

8.6HIGH

Key Information:

Vendor
Checkpoint
Status
Check Point Quantum Gateway, Spark Gateway And Cloudguard Network
Vendor
CVE Published:
28 May 2024

Badges

🥇 Trended No. 1📈 Trended📈 Score: 110,000💰 Ransomware👾 Exploit Exists🟡 Public PoC🟣 EPSS 94%🦅 CISA Reported📰 News Worthy

What is CVE-2024-24919?

CVE-2024-24919 is a vulnerability found in Check Point Security Gateways, which are integral components in network security that provide robust protection against various cyber threats. This vulnerability specifically permits attackers to read sensitive information from these gateways when they are enabled with remote access VPN or Mobile Access Software Blades and exposed to the internet. The implications for organizations are significant, as it could lead to unauthorized access to critical information, undermining the security of their network infrastructure.

Technical Details

The vulnerability arises from specific configurations that allow unauthorized individuals to exploit remote access features of Check Point Security Gateways. When connected to the internet, these gateways can inadvertently expose sensitive internal information if not properly secured. The vulnerability has been cataloged as a critical issue, prompting Check Point to release a security fix aimed at mitigating the associated risks. Organizations must ensure that they implement this fix to safeguard their systems.

Impact of the Vulnerability

  1. Unauthorized Information Access: Attackers can potentially gain access to sensitive data flowing through the Check Point Security Gateways, leading to data breaches and leaks of confidential information.

  2. Increased Risk of Cyber Attacks: With the ability to read information, attackers may gather intelligence that facilitates further exploits, increasing the overall risk of comprehensive cyber attack strategies against an organization.

  3. Reputation Damage: The exposure of sensitive information and the realization of a security breach can lead to significant reputational harm for organizations, affecting customer trust and investor confidence.

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace as recent news articles suggest the vulnerability is being used by ransomware groups.

The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Affected Version(s)

Check Point Quantum Gateway, Spark Gateway and CloudGuard Network Check Point Quantum Gateway and CloudGuard Network versions R81.20, R81.10, R81, R80.40 and Check Point Spark versions R81.10, R80.20.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-24919
Created by geniuszlyy

CVE-2024-24919-nuclei-templater
Created by smackerdodi

News Articles

favicon imagecyfirma

Threat Actors Actively Exploiting CVE-2024-24919: Underground Forums Share IP Addresses of Vulnerable Check Point Security Gateway Devices - CYFIRMA

Published On : 2024-07-12 EXECUTIVE SUMMARY A critical vulnerability, identified as CVE-2024-24919, has been discovered in certain End-of-life (EOL) devices that no longer receive updates or patches...

3 months ago

favicon imageCybersecurityNews

Huge Surge in Attacks Exploiting Check Point VPN Zero-Day Vulnerability

Check Point published an advisory regarding a critical vulnerability, CVE-2024-24919, which has since seen a surge in exploitation attempts.

7 months ago

favicon image

Attacks Surge on Check Point's Recent VPN Zero-Day Flaw

One monitoring firm has detected exploitation attempts targeting CVE-2024-24919 from more than 780 unique IP addresses in the past week.

7 months ago

References

https://support.checkpoint.com/results/sk/sk182336

EPSS Score

94% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 🥇

    Vulnerability reached the number 1 worldwide trending spot

  • 📈

    Vulnerability started trending

  • 🦅

    CISA Reported

  • 💰

    Used in Ransomware

  • 👾

    Exploit known to exist

  • 📰

    First article discovered by TechTarget

  • Vulnerability published

  • Vulnerability Reserved

.