CVERadar
HIGH · CVSS 3.1 8.6CISA KEV · added 2024-05-30Metasploit modulePublic PoCKnown ransomware useEPSS 99.98% (p100)Threat level 93

CVE-2024-24919: Check Point Quantum Security Gateways Information Disclosure Vulnerability

Check Point · Quantum Security Gateways · NVD published 2024-05-29 · posted 2026-10-21 · last modified 2026-08-05

What it is

Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerability is available.

WeaknessCWE-200
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N (source: [email protected])
CISA due date2024-06-20 (for US federal agencies under BOD; a good deadline for everyone)
ATT&CK tacticsExecution → Stealth → Credential Access → Collection

Exploitation evidence

First exploit evidence seen: 2024-05-30 (earliest date across the sources below).

Exploited in the wild

  • CISA KEV: listed since 2024-05-30. Source

Public exploit code

Metasploit

GitHub proof-of-concept repositories

56 public repositories from 55 accounts, first seen 2024-05-30. Most starred: seed1337/CVE-2024-24919-POC (47 stars), view repository.

Verify before running: public PoCs can be malicious. Read the code and only run it in an isolated lab. A PoC means exploit code is public, not that this CVE is exploited in the wild.

Sources: CISA KEV · Rapid7 Metasploit Framework module metadata · nomi-sec/PoC-in-GitHub.

Defend the Chain

The attack chain for CVE-2024-24919 laid across the MITRE ATT&CK Enterprise tactics. Solid cards come from the MITRE CTID KEV mappings; dashed cards are inferred by CVERadar from the CWE or description. Correct defences are real ATT&CK mitigations for that technique.

Threat level 93/100
Defender level 1 · 0 XP
Chain links broken: 0/5

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Stealth

Defense Impairment

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Pick a red technique card on the board, then choose the defence that stops it.

Defend against T1059.004 Unix Shell CTID: secondary impact

CVE-2024-24919 is an information disclosure/arbitrary file read vulnerability within Check Point's Quantum Security Gateway products. It's been reported that attacker are leveraging this vulnerability to retrieve, all files on the local file system, read sensitive data and extract credentials for all local accounts, including Active Directory, SSH keys, and certificates.

How to fix it

CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. (source: CISA KEV)

Fixed versions

NVD does not list a fixed version for this CVE. Use the vendor advisory below.

Derived from the NVD CPE configuration (versionEndExcluding / versionEndIncluding). Always confirm with the vendor advisory.

Vendor advisories and patches

MITRE ATT&CK mitigations for this chain

  • M1038 Execution Prevention (for T1059.004) : Use application control where appropriate. On ESXi hosts, the `execInstalledOnly` feature prevents binaries from being run unless they have been packaged and signed as part of a vSphere installation bundle (VIB).
  • M1027 Password Policies (for T1003.003, T1003.008) : Ensure that local administrator accounts have complex, unique passwords across all systems on the network.
  • M1026 Privileged Account Management (for T1003.003, T1003.008) : Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled, as this is often equivalent to having a local administrator account with the same password on all systems. Follow best practices for design and administration of an enterprise network to limit p
  • M1017 User Training (for T1003.003) : Limit credential overlap across accounts and systems by training users and administrators not to use the same password for multiple accounts.
  • M1041 Encrypt Sensitive Information (for T1003.003) : Ensure Domain Controller backups are properly secured.
  • M1057 Data Loss Prevention (for T1005) : Data loss prevention can restrict access to sensitive data and detect sensitive data that is unencrypted.

Detection Generic guidance

  • Execution: Watch for the service process spawning shells or script interpreters (cmd.exe, powershell, sh, bash, python) via EDR process-tree rules.
  • Credential Access: Monitor for credential dumping, unusual LSASS access and sudden authentication from new sources.
  • Collection: Watch for bulk reads of databases, file shares or mailboxes by the affected service.

Response checklist Generic guidance

  1. Inventory: find every instance of the affected product and version (include internet-facing and forgotten ones).
  2. Patch or mitigate per the vendor advisory; if you cannot patch, remove internet exposure or apply the vendor workaround.
  3. Assume compromise if the system was exposed before patching: hunt for the indicators in the advisory and review logs back to the disclosure date.
  4. Rotate credentials and secrets stored on or used by the affected system if compromise cannot be ruled out.

Sources