CVE-2024-24919

This vulnerability is like leaving the front door of your building slightly open—not fully breaking in, but letting someone peek at sensitive items once they get through the usual entry route. In this case, attackers can read certain confidential information from Check Point Security Gateways after connecting through the affected remote access methods, without needing a login.

This matters if your business uses Check Point Security Gateways such as Quantum Gateway, Quantum Security Gateway, Spark Gateway, or CloudGuard Network Security, and you have Remote Access VPN or Mobile Access Software Blades enabled. Because no authentication is required, the key question is whether an attacker can reach the gateway from the internet through those remote access paths.

This is RED because it is confirmed in CISA KEV and was used in ransomware campaigns, meaning real attackers have targeted this weakness. Your exposure is specifically tied to internet-reachable remote access (Remote Access VPN or Mobile Access blades), so affected businesses should act now rather than waiting for symptoms.

1. Confirm product and feature exposure

   • Identify whether you run any of the affected Check Point Security Gateways: check point quantum gateway, check point spark, quantum spark firmware, quantum security gateway firmware, spark gateway and cloudguard network, cloudguard network security (and the related normalized names listed above).
   • In your management console/configuration, confirm whether Remote Access VPN or Mobile Access Software Blades are enabled.
   • Determine whether the gateway is reachable from the internet via those access methods.

2. Determine whether you are vulnerable

   • If the gateway is internet-reachable and Remote Access VPN or Mobile Access Software Blades are enabled, treat the system as potentially exposed.
   • Compare your current security update level to Check Point’s CVE-2024-24919 remediation guidance (use only trusted sources from Check Point).

3. Patch or mitigate using vendor instructions

   • Apply the vendor remediation by installing the security updates from trusted sources.
   • Use the linked Check Point workaround guidance if you cannot patch immediately: https://support.checkpoint.com/results/sk/sk182336
   • If mitigations are not available for your situation, follow the vendor/CISA direction to discontinue use of the product until it is remediated.

4. After changes: verify and monitor

   • Re-check that the relevant Remote Access VPN/Mobile Access blades remain configured as intended, and confirm the gateway is updated/mitigated.
   • Monitor for unusual access to remote access endpoints around the time of exposure, and validate that the remote access services still function normally after the update/mitigation.

5. Timing

   • CISA KEV remediation due date: 2024-06-20. Since this is already listed as exploited-in-the-wild, prioritize remediation immediately.

Severity is high (CVSS 8.6) with network reachability and no authentication or user interaction required. The weakness is an information disclosure issue (CWE-200) that lets an attacker read certain sensitive information from Check Point Security Gateways after connecting through specific remote access methods. Confirmed exploitation status: listed in the CISA KEV (added 2024-05-30) with a CISA remediation due date of 2024-06-20; it was used in ransomware campaigns. Exploitation maturity: weaponization is indicated only at the “detection template only” level in the provided findings, but KEV status confirms real-world targeting. EPSS is reported as 100.0% with a rising trend, but public decisioning should rely primarily on the confirmed KEV exploitation for urgency. PULSE notes sustained attention due to exploitation by an actor referenced as Qilin.