CVE-2024-24919
Check Point Quantum Security Gateways Information Disclosure Vulnerability
Description
CVE-2024-24919 is a high-severity information disclosure vulnerability in Check Point Security Gateways that allows an unauthenticated remote attacker to read sensitive information from internet-connected gateways with Remote Access VPN or Mobile Access Software Blades enabled. With a CVSS v3.1 base score of 8.6, the vulnerability permits path traversal-style access to arbitrary files on the gateway, including password hashes and configuration data. CISA has added CVE-2024-24919 to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 20, 2024, with a confirmed ransomware association. Its EPSS score of 94.34% at the 100th percentile confirms near-universal active exploitation, making this one of the most aggressively targeted vulnerabilities affecting network security appliances.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| checkpoint | quantum spark firmware | r80.40; r81; r81.10; r80.20 |
| checkpoint | quantum security gateway firmware | r80.40; r81.20; r81.10; r81 |
| checkpoint | cloudguard network security | r80.40; r81; r81.10; r81.20 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
References
- https://support.checkpoint.com/results/sk/sk182336(Mitigation, Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-24919(US Government Resource)
- https://www.mnemonic.io/resources/blog/advisory-check-point-remote-access-vpn-vulnerability-cve-2024-24919/(Third Party Advisory)
Weakness Type
Arbitrary File Read via Path Traversal
CVE-2024-24919 is an information disclosure vulnerability that allows an unauthenticated attacker to read arbitrary files from Check Point Security Gateways. The weakness exists in how the gateway processes requests when Remote Access VPN or Mobile Access Software Blades are enabled. An attacker can send specially crafted requests that traverse the file system to read sensitive files that should not be accessible, including local user password hashes, SSH keys, certificate files, and configuration data. Path traversal vulnerabilities in security appliances are exceptionally dangerous because these devices sit at the network perimeter and are designed to be the first line of defense. Learn more about path traversal vulnerabilities at CWE-22.
Impact Analysis
The impact of CVE-2024-24919 is severe, with the CVSS vector reflecting maximum confidentiality compromise with a changed scope. Confidentiality is fully compromised because the vulnerability allows reading arbitrary files from the Check Point gateway, including /etc/shadow equivalent files containing local account password hashes, SSL/TLS private keys, VPN configuration files, LDAP bind credentials, and any other sensitive data stored on the appliance. Attackers have been observed extracting password hashes for local accounts and then cracking them to gain VPN access.
The changed scope (S:C) in the CVSS vector is critically important — it indicates that the vulnerability in the Check Point gateway can impact resources beyond the vulnerable component itself. Stolen VPN credentials provide the attacker with legitimate network access, enabling them to pivot into the internal network and compromise additional systems. This makes CVE-2024-24919 not just a gateway compromise but a potential entry point for full network infiltration.
While the CVSS vector shows no direct integrity (I:N) or availability (A:N) impact, the practical consequences extend far beyond simple file reading. The confirmed ransomware association demonstrates that attackers are using extracted credentials to gain VPN access, move laterally through internal networks, and deploy ransomware. The EPSS score of 94.34% at the 100th percentile combined with the trivial exploitation requirements — no authentication, no user interaction, low complexity — makes this vulnerability maximally dangerous for any organization with an affected Check Point gateway exposed to the internet.
Exploit Maturity
CVE-2024-24919 has reached maximum exploit maturity with mass exploitation observed worldwide and a confirmed ransomware association. CISA has included it in the Known Exploited Vulnerabilities catalog with an urgent remediation deadline of June 20, 2024. The EPSS score of 94.34% at the 100th percentile places it among the most actively exploited vulnerabilities in existence.
Security firm mnemonic published detailed threat intelligence at mnemonic.io documenting active exploitation observed since at least April 2024, weeks before the vulnerability was publicly disclosed. Attackers were observed extracting local account password hashes, cracking them, and using the credentials to establish VPN sessions that bypassed multi-factor authentication for local accounts. Check Point released a security fix and detailed mitigation guidance through their support advisory sk182336.
The confirmed ransomware classification by CISA reflects the direct use of this vulnerability in ransomware attack chains. Threat actors exploit CVE-2024-24919 to extract credentials, gain VPN access, perform internal reconnaissance, and ultimately deploy ransomware across the victim's network. The combination of trivial exploitation, no authentication requirement, and the high value of extracted credentials makes this vulnerability a preferred initial access vector for both ransomware operators and state-sponsored threat actors.
Remediation
-
Apply the Check Point security hotfix immediately. Install the hotfix referenced in Check Point advisory sk182336 for all affected products including Quantum Security Gateways, Quantum Spark appliances, and CloudGuard Network Security running firmware versions R80.20, R80.40, R81, R81.10, and R81.20.
-
Reset all local account passwords on the gateway. After patching, immediately change all local user account passwords on the Check Point gateway. Attackers may have already extracted password hashes before the patch was applied. Pay special attention to accounts used for VPN authentication, as these credentials provide direct network access.
-
Rotate all certificates and pre-shared keys. SSL/TLS certificates, VPN pre-shared keys, and any other cryptographic material stored on the gateway should be considered potentially compromised. Generate new certificates and keys, and revoke the old ones across all dependent systems.
-
Audit VPN access logs for unauthorized sessions. Review VPN authentication logs for connections from unexpected IP addresses or at unusual times, particularly for local accounts rather than directory-authenticated accounts. Look for connections that began before the patch was applied, as these may indicate credential theft via CVE-2024-24919.
-
Enforce multi-factor authentication for all VPN access. Ensure all VPN users authenticate through a centralized identity provider with MFA enforcement. Local accounts on the gateway should be disabled for VPN access whenever possible, as they are the primary target for credential extraction through this vulnerability.
Technical Details
CVE-2024-24919 is an information disclosure vulnerability in Check Point Security Gateways with a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, resulting in a high base score of 8.6. The network attack vector (AV:N) means the vulnerability is exploitable from anywhere on the internet. The low attack complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N) make exploitation trivial and fully automatable.
The vulnerability exists in the request handling logic of Check Point Security Gateways when Remote Access VPN or Mobile Access Software Blades are enabled. These software blades expose network-facing services that process incoming requests from VPN clients and mobile users. The gateway fails to properly validate and sanitize file path components in certain requests, allowing an attacker to traverse the file system and read arbitrary files accessible to the gateway process.
The changed scope (S:C) reflects that the vulnerability's impact extends beyond the Check Point gateway itself. Files readable through this vulnerability include local user password hashes (similar to /etc/shadow), SSH authorized keys, SSL/TLS private keys, VPN configuration files containing pre-shared keys, and LDAP bind credentials. These extracted credentials enable the attacker to establish legitimate VPN sessions, effectively pivoting the attack from the gateway to the entire internal network. The confidentiality impact is high (C:H), while integrity (I:N) and availability (A:N) are not directly affected by the file read operation. Affected products include Quantum Security Gateway firmware R80.40, R81, R81.10, and R81.20, Quantum Spark firmware R80.20, R80.40, R81, and R81.10, and CloudGuard Network Security R80.40, R81, R81.10, and R81.20.
Frequently Asked Questions
What is CVE-2024-24919?
CVE-2024-24919 is a high-severity information disclosure vulnerability in Check Point Security Gateways that allows an unauthenticated remote attacker to read arbitrary files from the appliance when Remote Access VPN or Mobile Access Software Blades are enabled. It has a CVSS v3.1 score of 8.6 and is massively exploited in the wild.
Is CVE-2024-24919 being used in ransomware attacks?
Yes. CISA has confirmed a direct ransomware association for CVE-2024-24919. Attackers extract local account password hashes from the gateway, crack them, and use the credentials to establish VPN sessions into the victim's network, ultimately deploying ransomware.
What information can attackers steal through CVE-2024-24919?
Attackers can read arbitrary files from the Check Point gateway, including local user password hashes, SSL/TLS private keys, VPN pre-shared keys, SSH keys, LDAP bind credentials, and gateway configuration files. The most critical extraction targets are password hashes for local VPN accounts.
Does multi-factor authentication protect against CVE-2024-24919?
MFA protects directory-authenticated VPN accounts but does not protect local accounts on the gateway. Attackers have specifically targeted local accounts where MFA may not be enforced. After patching, organizations should ensure all VPN access requires MFA through a centralized identity provider and disable local account VPN access where possible.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.