THE THREAT
On May 28th, Check Point confirmed the existence of an actively exploited zero-day vulnerability impacting Check Point Security Gateways. The vulnerability, tracked as CVE-2024-24919 (CVSS: 7.5), is an information disclosure vulnerability. Exploitation would allow a remote threat actor to read certain information on Check Point Security Gateways if IPSec VPN or Mobile Access Software Blades are enabled.
Details relating to CVE-2024-24919 and real-world exploitation are currently minimal. According to Check Point, attacks have been confirmed against a “small number of customers”. Threat actors are believed to be exploiting the vulnerability to steal information that would enable remote access into victim environments. As exploitation is ongoing, it is paramount that organizations utilizing Check Point Security Gateways apply the available remediations.
What we’re doing about it
- The eSentire Threat Intelligence team is actively tracking this topic for additional details and detection opportunities
- eSentire Managed Vulnerability Service (MVS) will add the relevant plugins as they become available
What you should do about it
- After performing a business impact review, apply the relevant hotfixes released by Check Point:
- Quantum Security Gateway and CloudGuard Network Security Versions: R81.20, R81.10, R81, R80.40
- Quantum Maestro and Quantum Scalable Chassis: R81.20, R81.10, R80.40, R80.30SP, R80.20SP
- Quantum Spark Gateways Version: R81.10.x, R80.20.x, R77.20.x
- If patching is not immediately possible, disable IPSec VPN and Mobile Access Software Blades to prevent exploitation
- Employ Multi-Factor Authentication (MFA) on remote services
Additional information
CVE-2024-24919 impacts all Check Point Security Gateways that have either IPSec VPN or Mobile Access Software Blades enabled. As exploitation is ongoing, organizations employing vulnerable products need to take immediate action to address the vulnerability.
While details on real-world exploitation are currently minimal, Check Point has confirmed that exploitation has impacted organizations that continue to use password only authentication. It is probable that exploitation of CVE-2024-24919 enables the theft of credentials, which may then be used to achieve initial access; post compromise activity is unknown at the time of writing. Employing a Multi-Factor Authentication (MFA) solution will significantly limit the value of compromised credentials, as they will no longer enable direct access.
The eSentire Threat Intelligence team continues to track this topic for additional details relating to exploitation and information relevant to engineering new detections.
References:
[1] https://blog.checkpoint.com/security/enhance-your-vpn-security-posture
[2] https://support.checkpoint.com/results/sk/sk182337
[3] https://nvd.nist.gov/vuln/detail/CVE-2024-24919
[4] https://www.tenable.com/cve/CVE-2024-24919
