This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Check Point Security Gateways critical vulnerability

Check Point has released a hotfix for a critical and already actively exploited vulnerability [1]. The company recommends updating immediately. Affected products and their fixes [1]: Quantum Security Gateway and CloudGuard Network Security: R81.20, R81.10, R81, R80.40 Quantum Maestro and Quantum Scalable Chassis: R81.20, R81.10, R80.40, R80.30SP, R80.20SP Quantum Spark Gateways: R81.10.x, R80.20.x, R77.20.x

Check Point - information disclosure (CVE-2024-24919)
CVSS 8.6 (High)

An unauthenticated remote attacker can gain unauthorized access to sensitive information, such as SSH keys or user passwords, on systems with Remote Access VPN or Mobile Access Blades enabled. Exploitation attempts observed so far target remote access scenarios with old local accounts using password-only authentication. This vulnerability should not affect the functionality of Site-to-Site IPSEC VPN [1] [2].

The vulnerability is present in products:

  • CloudGuard Network;
  • Quantum Maestro;
  • Quantum Scalable Chassis;
  • Quantum Security Gateways;
  • Quantum Spark Appliances;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

IOC: Reconnaissance IP: 82.180.133[.]120, Exploitation IP: 87.120.8[.]173, Exploitation IP: 23.227.203[.]36, Exploitation IP: 203.160.68[.]12

More information:

The vulnerability was publicly disclosed 29. 5. 2024.

By CESNET, z.s.p.o. Michaela Jarošová on 30. 5. 2024.

CESNET, z.s.p.o. Logo